Project OBD2 - Mobile App v1.2.1

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
Here is the disparity I'm going on about. The Thai ZS EV app has (in my decompilation, in sources/p072b/p108c/p109a/p110a/C1193a.java):

static {
String[][] strArr =
{new String[]{"TBOX", "-", "711"},
new String[]{"GW", "-", "710"},
new String[]{"SDM", "-", "730"},
new String[]{"SCU", "-", "771"},
new String[]{"VCU", "-", "7e3"},
new String[]{"TC", "-", "782"},
new String[]{"DCDC", "-", "785"},
new String[]{"BMS", "-", "781"},
new String[]{"EVCC", "-", "776"}, // NOTE
new String[]{"EPB", "-", "723"},
new String[]{"EPS", "-", "721"},
new String[]{"SCS/ABS", "-", "720"},
new String[]{"FVCM", "-", "733"},
new String[]{"FDR", "-", "734"},
new String[]{"BCM", "-", "740"},
new String[]{"PEPS", "-", "745"},
new String[]{"HVAC", "-", "750"},
new String[]{"ESCL", "-", "742"}, // OVMS has no definition
new String[]{"IPK", "-", "760"},
new String[]{"FICM", "-", "761"},
new String[]{"TPMS", "-", "724"},
new String[]{"RDA", "-", "732"}
};


OVMS has in trunk\vehicle\OVMS.V3\components\vehicle_mgev\src\mg_software_versions.cpp:
constexpr uint32_t ecus[] = {
bmsId, dcdcId, vcuId, atcId, bcmId, gwmId, tpmsId, pepsId, 0x761u, 0x760u, 0x784u,
0x776u, 0x771u, 0x782u, 0x734u, 0x733u, 0x732u, 0x730u, 0x723u, 0x721u, 0x720u, 0x711u
};
const char *names[] = {
"BMS", "DCDC", "VCU", "ATC", "BCM", "GWM", "TPMS", "PEPS", "ICE", "IPK", "EVCC",
"PLC", "SCU", "TC", "FDR", "FVCM", "RDRA", "SRM", "EPB", "EPS", "ABS", "TBOX"
};

with in trunk\vehicle\OVMS.V3\components\vehicle_mgev\src\mg_obd_pids.h:
constexpr uint32_t bmsId = 0x781u;
constexpr uint32_t dcdcId = 0x785u;
constexpr uint32_t vcuId = 0x7e3u;
constexpr uint32_t atcId = 0x750u;
constexpr uint32_t bcmId = 0x740u;
constexpr uint32_t gwmId = 0x710u;
constexpr uint32_t tpmsId = 0x724u;
constexpr uint32_t pepsId = 0x745u;
constexpr uint32_t ipkId = 0x760u;
constexpr uint32_t evccId = 0x784u;

So the Thai ZS EV app doesn't use the ECU at 0x784 at all, doesn't call any ECU "PLC", and it calls the one at 0x776 "EVCC".

OVMS calls 0x784 "EVCC", and 0x776 "PLC".

The OVMS has no definition for ECU 742, which the Thai ZS EV app calls ESCL.

Edit 9/Jun/2021: I'm now convinced that the ZS EV is just missing the OBC ECU (0x784).
OVMS is missing ESCL (0x742), and is misnaming the OBC as "EVCC". OVMS's "PLC" (0x776) is probably better named as "EVCC" (that's the name that appears in the owner's manual as a fuse description, and appears elsewhere in SAIC documentation).
 
Last edited:

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
I had my firmware updates done today. As stated by the service people, 6 firmwares were updated. Here are my differences summarised:

Firmware composite before & after.png

I seem to have an unseen version for TC (Traction Control), DC-DC, BMS [ Edit: it has been seen, just not in the spreadsheet yet ], HVAC. ECU 784 V104 has been seen on the Slack group once, but is missing from the spreadsheet because of the ECU naming conflict. I hope to sort out the names soon; thanks to Ohm on Slack, the PID for ECU names seems to be service 22 PID f183.

Edit: The information from Slack is that "ECU 784" is in fact the OBC, possibly also called the EVCC. The one called "EVCC" in the app is really PLC, possibly standing for Power Line Communications, or the power distribution unit.

Edit 2: Renamed "ECU 784" to "OBC".
 
Last edited:

JodyS21

Well-known Member
Joined
Jan 24, 2021
Messages
784
Reaction score
706
Points
96
Milton Keynes
Driving
MG ZS EV
I had my firmware updates done today. As stated by the service people, 6 firmwares were updated. Here are my differences summarised:

View attachment 3479
I seem to have an unseen version for TC (Traction Control), DC-DC, BMS, HVAC. ECU 784 V104 has been seen on the Slack group once, but is missing from the spreadsheet because of the ECU naming conflict. I hope to sort out the names soon; thanks to Ohm on Slack, the PID for ECU names seems to be service 22 PID f183.
Have you noticed what the changes are?
From what we think of the BMS version number format, you had a build from 11th January previously, now you have one from 28th January.
From ECU Module version spreadsheet
28/01/2020 (622 A00)0128622A00Australian version? (a car was updated 22/3/2021)
So the BMS is a known one. Having your update done today would suggest that that is still the latest Australian version.
I've never seen your previous BMS version reported before.

The latest UK/European version is also "622" although it has a build date of 10th February, so it suggests that the 622 versions are probably the same - probably have the same fixes within, but then the builds are slightly different for the countries.
The dates also imply that MG got the fix done for AUS countries etc first, maybe tested there for a week or so before releasing the EU version.

Your new IPK is the version that everyone seems have, your old version doesn't appear anywhere in the spreadsheet. Is your car a very very early one?
 

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
Your new IPK is the version that everyone seems have, your old version doesn't appear anywhere in the spreadsheet. Is your car a very very early one?
No, mine was made December 2020. There is at least one batch of Australian delivered ZSs that came before it, and UK delivered vehicles over a year before that, I think.

So I can only presume that they were cutting corners on the pre-delivery process.
 

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
Have you noticed what the changes are?
The range is now displaying in the instrument LCD lower left corner, as it does for many, if not most Australian delivered ZS EVs. The annoying warning on every start up that rear cross traffic alerts are enabled is gone. The infotainment delays seem to be shorter. I think that the hesitancy when starting off in Eco mode (perhaps other modes as well) seems to be lessened. Hopefully it will now charge to 450V instead of nearly 455V, but I haven't had a chance to check that as yet.
I always had the graphics when you change driving modes, and they are still there.
 

JodyS21

Well-known Member
Joined
Jan 24, 2021
Messages
784
Reaction score
706
Points
96
Milton Keynes
Driving
MG ZS EV
The range is now displaying in the instrument LCD lower left corner, as it does for many, if not most Australian delivered ZS EVs. The annoying warning on every start up that rear cross traffic alerts are enabled is gone. The infotainment delays seem to be shorter. I think that the hesitancy when starting off in Eco mode (perhaps other modes as well) seems to be lessened. Hopefully it will now charge to 450V instead of nearly 455V, but I haven't had a chance to check that as yet.
I always had the graphics when you change driving modes, and they are still there.
Hang on a minute... if you didn't have the range showing then your car didn't have the "comfort pack 2" installed (correctly anyway).
A car made in Dec 2020 and indeed sold from a while before that, should have come with the comfort pack 2 software on it.

The cars with the driving modes graphics were quite early off the production line......there's something not adding up with your car/it's production date.....
 

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
Hang on a minute... if you didn't have the range showing then your car didn't have the "comfort pack 2" installed (correctly anyway).
I had plenty of other signs of the comfort 2 pack: outside temperature display, charge with doors unlocked, etc. Two glaring ones were missing: the range display, and charging to 450 V.

As I said, my guess is that it was partially and/or incorrectly installed.
 

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
I'm not very good at patching APKs, but I've patched version 1.2.1 to show the OBC firmware instead of TBOX. The car has to be AC charging and turned on for this version number to be seen; else it will be "NO DATA". I also took the liberty of changing the label for "EVCC" to "EVCC/PLC", even though not all the OVMS developers agree (yet) that these are the same thing. This is ECU 0x776.

I tried to add OBC at the bottom of the list, so that those with TBOX can see all their firmwares, but I screwed up and it crashed as soon as I touch the Firmware button on the main screen.

I also tried to turn all the icons pink instead of green, but it still displays as green on my phone.

I didn't think to change the version string, sorry. And I can't find the "id" or internal version number, so this installs as an update, replacing the original.

So you might want to wait till I get things more refined. But if you don't mind the rough edges, here is a link to my patched version. Ideally, the original author would change the ECU list in source code, adding "OBC" as "784" as a 23rd ECU. But until that happens, this is the easiest way to discover your OBC's version string.

Link to the patched APK; use at your own risk, as per the original:
Download eZS_13_patched_simp.apk .

Edit: sample screenshot (FDR screwed up; my OBD2 dongle and the eZS aren't a great pair, usually I have to do a few runs and edit together a complete table). Unedited, except for a 50% shrink:

Screenshot_eZS_patch1_sm.jpg
 
Last edited:

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
I found the bug with adding OBC at the bottom: the compiler had used a register that I still needed for the last array entry. That was easy enough to fix. Still overwrites the original, still no pink icons. Bit it's now version 1.2.1p1:

Screenshot_vers 1.2.1p1 sm.jpg


My results, unedited except to shrink 50% and compose two screenshots into one, to show all 23 versions (I didn't try too hard to get good results):

Screenshot_v121p1 comp sm.jpg


Download link: eZS_13_patched1.apk .
 

JodyS21

Well-known Member
Joined
Jan 24, 2021
Messages
784
Reaction score
706
Points
96
Milton Keynes
Driving
MG ZS EV
Did you kinda “uncompile” the apk file to do this, this is something I’ve not played around with
 

Coulomb

Active Member
Joined
Apr 24, 2021
Messages
93
Reaction score
43
Points
21
Brisbane, Australia
Driving
MG ZS EV
Did you kinda “uncompile” the apk file to do this, this is something I’ve not played around with
Yes, to try and find where to patch. In the end, there was only one occurrence of the string "TBOX" in the dot dex file, and only one occurrence of the string for that ECU's number. So my first patch attempt didn't even require the decompilation, but that attempt didn't digitally sign the app, so the app would not install.

After some more Googling, I found that the best tool was apktool, and signapk to go with it. Apktool is more of a disassembler than decompiler, so the code it produces is much harder to read. However, it is source code, so its possible to make changes safely that change the length of a function or data item, which is an advantage. Apktool is able to reassemble just the changed code, and puts the complex apk file back together. Signapk can then sign the apk.

Typing this now, I realise that I might have been able to use just signapk on my hand patched apk, but I'm glad that I have learned the more powerful technique.

Sorry if this is way too technical. Patching is a field that seems to attract few devotees. I just happen to be one of them.
 
Support us by becoming a Premium Member

Latest MG EVs video

MG EV hot topics covered in our weekly podcast
Subscribe to our YouTube channel
Top Bottom