NBT1 HDD to SSD replacement upgrade

[Admin]

All credits goes to superwofy

A possible way to change BMW NBT HDD to SSD.

To my knowledge this hasn't been done publicly yet. It's possible on EVO units however, NBT refuses to mount SSDs.
I've achieved this swap by patching the srv-hddmgr binary running on HU-Intel.

Based on previous comments on other forums, the assumption was that SMART variables were what caused the NBT to refuse SSDs. There's actually a temperature check function which always returns an error on my SSD.

void FUN_0807af78(void)

{
  FUN_0807ae43();                                    // Bypass this function call with NOPs
  return;
}

FUN_0807ae43() makes the calls for readtemp_direct and will return "__errnum". For some reason on SSDs this has issues and leads to the disk being unmounted.


A trivial patch changes 5 bytes at 0x807AF7F from "E9 BF FE FF FF" to "90 90 90 90 90"

Full function code:

uint FUN_0807ae43(undefined4 param_1,int *param_2)

{
  uint __errnum;
  int iVar1;
  uint uVar2;
  uint uVar3;
  char *pcVar4;
  undefined4 local_70;
  byte local_69;
  undefined local_68;
  undefined local_5c;
  undefined local_5b;
  undefined4 local_58;
  undefined local_4c;
  undefined local_4b;
  undefined local_4a;
  undefined local_48;
  undefined local_3e;
  undefined4 *local_3c;
  undefined4 local_38;
  undefined *local_34;
  undefined4 local_30;
  undefined local_22;
  undefined local_21;
  undefined local_20;
  undefined local_1f;
  byte local_18;
  byte local_17;
  byte local_15;
  undefined local_d;
 
  memset(&local_70,0,0x34);
  local_34 = &local_22;
  local_70 = 0xc0;
  local_5b = 0x10;
  local_5c = 0x16;
  local_4c = 0x85;
  local_4b = 6;
  local_4a = 0x20;
  local_3e = 0xfc;
  local_48 = 0;
  local_38 = 0x34;
  local_30 = 0x16;
  local_58 = 0x34;
  local_3c = &local_70;
  FUN_0807a516(3,4,"HDD_IO: readtemp_direct");
  __errnum = devctlv(param_1,0xc0340c07,2,2,&local_3c,&local_3c,0);
  iVar1 = (char)local_15 * 10;
  *param_2 = iVar1;
  FUN_0807a516(99,4,
               "HDD_IO: readtemp_direct[dump_brief]: retCode=%i, cam_status[r=0x%x,m=0x%x], scsi_sta tus=0x%x temp=%i [0.1 degrees]"
               ,__errnum,local_69,local_69 & 0x3f,local_68,iVar1);
  FUN_0807a516(99,4,
               "HDD_IO: readtemp_direct[dump_scsi_sense]: is_valid=%i, sense=0x%x, asc=0x%x, ascq=0x %x"
               ,(uint)(int)(char)local_69 >> 0x1f,local_21,local_20,local_1f);
  uVar2 = (uint)local_15;
  uVar3 = (uint)local_18;
  FUN_0807a516(99,4,
               "HDD_IO: readtemp_direct[dump_ata_sense]: status=0x%x, error=0x%x, flags=0x%x, sector _count=0x%x"
               ,local_d,local_17,uVar3,uVar2);
  if (__errnum == 0) {
    if (local_17 == 0) {
      return 0;
    }
    __errnum = (uint)local_17;
  }
  pcVar4 = strerror(__errnum);
  FUN_0807a516(3,2,"Unable to get EIDE temperature [direct][error: %i|%s]!",__errnum,pcVar4,uVar3,
               uVar2,iVar1);
  return __errnum;
}

Warning! The following can lead to a brick which requires the EMMC to be repaired. I will describe this in a separate post. Execute the commands that replace the binary carefully. The startup script which loads all the programs is very strict at will restart the system if srv-hddmgr crashes potentially leading to a boot loop.

1. Using serial access enable SSH
2. The original hard drive needs to be unlocked so that it can be imaged:
   1. Run and take a note of the values:
      1. adjinfo --get=E2P.Networking.Eth0MacAddr
      2. adjinfo --get=E2P.Networking.Bt0Addr
      3. adjinfo --get=E2P.ProdLogistic.SerialNo
   2. Copy complete hddsecurity + libs to a USB drive in a folder called "hddsec". Plug the drive into NBT's USB1 slot. Run:
      1. mkdir /fs/sda1/work
      2. cp /fs/usb0/hddsec/* /fs/sda1/work
      3. cd /fs/sda1/work && chmod +x hddsecurity
      4. ./hddsecurity -d **Eth0MacAddr**,**Bt0Addr**,**SerialNo** (replace the **s and values with data from adjinfo)
3. Remove the drive and make an image of it. I merely copied my drive. I did not bother with expanding the media partition since its capacity doesn't get displayed properly. Restore the image to the SSD.
4. Start NBT with the SSD installed.
   1. Copy srv-hddmgr to the root of a USB drive. Plug the drive into NBT's USB1 slot. Run:

   2. mount -uw /fs/sda0 && \
      mv /fs/usb0/srv-hddmgr /opt/sys/bin/ && \
      chmod 0775 /opt/sys/bin/srv-hddmgr && \
      sleep 5 && \
      mount -ur /fs/sda0 && OnOffDSICommander appreset

   3. Unit will restart and the SSD should now be mounted.

Everything should work now. I've tested music import, navigation and navigation updating.

 

[eu30]

Hello, on HU NBT works?additional help is possible?

 

[Admin]

Hi,
As you see it is for NBT

 

[eu30]

yes, I saw something but I didn't understand exactly the procedure, I don't know exactly the software with which to do this, maybe you can give me more details, thank you very much

 

[Admin]

I dont know and dont see anything else what to add here.
No offense, but these instructions are not meant for beginners, more likely for those who are repairing them (headunits) or at least knows unix/linux.

 

[InDaNet]

Hello, Is this also possible on CIC units? I have something like this on an F11 from 2011, and I think that that hdd is quite "tired" anyway.

 

[Admin]

Hello and welcome @InDaNet
With CIC there is different story, because it uses IDE 44 pin connection and majority of sata<>ide adapters simply wont work with CIC/QNX (wont be recognized by the system).
Other than that it is just cloning image to the new hdd/ssd.

 

[InDaNet]

Hello,
Thanks for the answer.
I was thinking of something like this "SSD Transcend SSD330 128GB IDE 2.5'' MLC TS128GPSD330".
Maybe it's compatible.
Can it be cloned with aomei or the old ghost? bit to bit?
Thank you

 

[Admin]

It looks like compatible drive, but never tried it.

Can it be cloned with aomei or the old ghost? bit to bit?

I was always using Paragon Hard Disk Manager which read/write 1:1 copy of if and no problem whatsoever.
HDD Raw Copy Tool - should also work.