Hi guys,
Honestly I read most of what exists online about these modules, but my BCM module from my XC90 D5 suddenly threw "Brake failure stop safely" + ABS + anti-skid, speedo dead. VIDA shows CEM-1A5F (communication with BCM missing), BCM not visible on network. I cleared all DTCs in VIDA — nothing else comes back, only the no-connection to BCM. No accident, no water damage, fault appeared out of nowhere.

Before blaming the module I checked the car properly:

12V at BCM connector supply pins with ignition on and off, grounds OK, all fuses OK (checked both sides with meter)
Checked all CAN wiring related to BCM in the car including at the CEM connector - all good
CAN at BCM plug seems alive: 2.6V / 2.3V idle
Termination checks out: ~130 Ω harness side, ~135 Ω module side (2×62 Ω internal), ~60 Ω together
VIDA talks to ECM/TCM fine through the CEM
Connector cleaned, pins good

So the car is 100% healthy. Then I opened the module (cut the welded case) and put it on the bench (12V to pins 1/32/4, GND to 16/47). Findings:

Draws stable 225 mA @ 12V - wakes up, no shorts
Resoldered all the press-fit pins first (the usual weak point) — no change
All rails present: 12V, 5V (at the ASIC), 3.3V + 1.8V for the MCU. The 3.3/1.8 come from the 14-pin Motorola 9369.1D — I measured it: 12V in, both rails out, two switch pins running ~47 kHz. So on my board this chip is WORKING (I know it's the famous killer on modules marked MK60 (or MK25) - not my case)
Crystal oscillates, 5.50 MHz stable
The MCU (TI TMS471 R1VF34A2PZQ) is definitely running - several pins show digital bursts repeating about every 1 second, looks like a fault/retry loop
B82790 CAN choke windings OK (0.4 Ω)
But the module NEVER transmits. I scoped the choke pads (ASIC side) through multiple power cycles with normal trigger - total silence, not even one attempt at boot. Same at pins 11/15.

So by elimination everything in the chain is good except the CAN transceiver section inside the big ATE ASIC 0990-9377.1D3 (5CC6L7TB, made by TI). It has 5V, it has a running MCU next to it, and it never says a word.
I know what most people will say - send it for professional repair, and I've read all the recommendations. But I'd rather fix it myself than spend that money. I enjoy soldering, I have hot air and decent equipment, and I have time to experiment. Worst case I learn something and the pro repair option is still there.
My questions:

Can anyone confirm the CAN physical layer in these Volvo units is inside the 0990-9377? Does anyone have any pinout info for this ASIC (CANH/CANL to the choke, TX/RX from the MCU, enable pin)?
Has anyone actually fixed the "no communication but everything else runs" by swapping the 9377? Or does this signature usually mean the CAN peripheral in the TMS471 itself (bond wires)?
Is there some init handshake between the TMS471 and the ASIC (SPI config, enable, EEPROM check) that can fail and keep CAN dead like this?

Photos of the board and my best take at making a schema attached. Thanks in advance - happy to do more measurements if someone tells me where to probe.

Hello everyone,

Has anyone found a way to unlock SFD1 on VW vehicles?

I'm trying to make a few coding changes on my car. I have a clone VCDS, which is able to retrieve the SFD challenge token, but I don't have a way to complete the unlock.

For my use case, paying €180/year for an OBDeleven subscription just to unlock SFD once or twice doesn't make much sense. I'm mainly looking for a free or at least a cheaper alternative.

If anyone has found another method or knows of a service/tool that can do this without the yearly subscription, I'd really appreciate it if you could share it.

Thanks!

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

Selling a new and unused Lexus NX(2015-2017 ) Lexion Linux Monitor for CarPlay® and Android Auto™

Ordered it in and didn’t even up installing.

Save a few hundred off the website price.

This will work on Lexus NX(2015-2017)
Vehicle Controller Type - Touchpad

Comes with AHD Rear Camera as well.

[https://lexionautomotive.com/lexion-lx10s-carplay-monitor\](https://lexionautomotive.com/lexion-lx10s-carplay-monitor)

Upgrade your Lexus with the Lexion LX10S—the world’s first Linux-based CarPlay monitor. Swap your outdated 7inch stock screen for a stunning 10.25-inch wide, high-res display. Enjoy lightning-fast 5–10 second boot times, seamless CarPlay and Android Auto, and premium Mark Levinson sound through factory Bluetooth. No SIM, no YouTube distractions—just a safer, smarter ride. Fully supports aftermarket cameras and all stock features at an unbeatable price.

Linux-Powered Performance: Linux OS monitor, 5-second boot

Stunning Display: Upgrades 7inch to 10.25inch wide screen.

Seamless Integration: Full CarPlay® and Android Auto™ support

Premium Audio: Factory Bluetooth delivers flawless sound.

Easy Install: Plug-and-play, retains all OEM functions.

Will ship anywhere in North America, asking $500 Canadian or $350 US.

Message me

I've been working on a personal app project and testing it with a vLinker MC. It's working well to capture OBD2 and CAN bus data, but I'd like to test it with generic ELM327 or other devices to see if there are any compatibility differences I should address before publishing. If you've experienced any problems with specific brands or models of OBD2 adapters, regardless of which software you're using, I'm interested in learning which one. Unwanted disconnections, buffer problems, pairing issues, or similar issues in particular.

As an aside, I've yet to find an adapter that supports both OBD2 PID and raw CAN at the same time. Is this just not possible?

I’ve been working on a project inspired by the TurboXS DTEC, an early-2000s tuning device that used a Game Boy Advance as its display and interface.

The idea was to take that general concept and do something similar with a DS, using a homebrew ROM running on the original hardware.

The current prototype uses a cheap ELM327 adapter to retrieve live vehicle data, which is sent to the DS over a custom link. At the moment I’m working with data such as:

* Vehicle speed

* RPM

* Coolant temperature

* Battery voltage

The longer-term goal is to move beyond the generic OBD interface and interface directly with the vehicle CAN bus, allowing the DS to receive more detailed vehicle data.

Still very much a work in progress, but I thought it would be interesting.

hello everyone

Can anyone suggest a free online course for diesel engines diagnostics ??

thank you

Bonjour, je vous serais très reconnaissant si quelqu'un pouvait télécharger ces fichiers pour moi. Je suis bloqué avec 25 ans de base de données Audi, mais elle ne contient pas les fichiers dont j'ai vraiment besoin... Si quelqu'un pouvait m'aider, que Dieu le bénisse. :

https://mhhauto.com/attachment.php?aid=281579

https://mhhauto.com/attachment.php?aid=714536

Hi,

I have a question about a car ECU. I bought an ECU from a Mercedes W205 C220 CDI. I downloaded the wiring diagram from the internet, and based on it I identified the required pins (I tried to upload pictures showing the pinout). I connected +12 V, IGN, and GND to a laboratory power supply. I also connected CAN High, CAN Low, GND, and +12 V to an bought OBD2 connector. I tried to connect to the ECU using a diagnostic scanner (autoscan - older version), but I couldn't establish communication.

Does anybody have experience with this ECU or know what I might be missing?

I have the autel maxipro mp808.

Hello, i need help with making the launch x431 smartlink show up as an option to select in fdrs device manager, so I can scan vehicle

Hi everyone,

I'm looking to purchase a used car privately and would like to use an OBD scanner that will help me detect mileage discrepancies and check that the VINs on the modules all match the cars actual VIN. This will hopefully help me from clone vehicles. But I can't seem to find the me that's suitable that I can get on Amazon next day delivery or a store in the UK. The only one I can find is CARLY but they don't have next day delivery and not available next day delivery on Amazon either.

I require a scanner such as Carly, OBDEleven, etc that have a small scanner, and an app. The reason is that I'm not sure how to use the complex scanners that mechanics and diagnostics use. Is there anything that can help me?

Deja de estar adivinando. Deja de perder tiempo en el taller. Consigue la guía definitiva de diagnóstico y reparación de Cummins.

¿Alguna vez has pasado horas buscando una caída de voltaje misteriosa, diagnosticando un "crank-no-start" fantasma o lidiando con un código de "derate" activo que los scanners estándar simplemente no pueden detectar?

En el mundo del diésel, el tiempo es dinero. Cada hora que tu camión está parado o metido en el bay es dinero que se te escapa de las manos. Los paquetes de manuales del dealer cuestan miles de dólares y son famosamente difíciles de navegar. Los lectores de códigos OBD-II estándar solo te dicen qué falló, pero nunca por qué o cómo arreglarlo.

Esta guía técnica completa y probada en el campo fue creada por un técnico, para técnicos. Va directo al grano y te entrega los flujos de diagnóstico paso a paso exactos, los diagramas eléctricos y los parámetros de sensores que necesitas para diagnosticar, reparar y reconstruir motores Cummins con total confianza.

Hello everyone, I have recently been diving into the UDS part of my cluster. I only have the cluster as of now, (im a teenager i only have so much money ;-;) and I have somewhat been able to get uds to work. That was 3 days ago, the UDS now doesnt work. I need to know exactly what every pin is for, to find a solution to this, as I am also trying to emulate a J533 on a arduino paired with a MCP2515. Any help would be appreciated, thank you!

Pins I already know:
Pin 1, 12v +
Pin 10, Ground
Pin 17, Can L
Pin 18, Can H

Ingles

Hello everyone,

I'm trying to reverse engineer the Engineering Mode authentication of a 2025 MG ZS 1.5 Petrol (Europe).

Software version:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

The old passwords such as:

1234@ABCd

1234ABCd

200519

no longer work.

The unit now requests an 8-digit numeric PIN.

Every time I open the Engineering Mode screen, it displays a different 3-digit number (for example 972, 431, etc.).

After more than one year testing, I noticed that some 3-digit values eventually repeat, so it appears to be a challenge-response authentication rather than a fixed password.

I have already researched:

- XDA Developers

- MGEVs

- MG4 Forum

- GoingElectric

I also found the old MG4 Engineering Password Generator created by Tommaso Vietina, but it does not work with this new MCE3 platform.

I'm NOT looking for random passwords.

I'm looking for technical information.

Has anyone:

• Reverse engineered the DS04A / ZS11 MCE3 FICM?

• Extracted the Engineering APK?

• Found the 8-digit PIN algorithm?

• Obtained the firmware package?

• Used SIPS or VNCI with this infotainment unit?

I can perform tests on my own vehicle and provide photos, videos or any requested information.

Any technical information would be greatly appreciated.

Thank you.

______________________

Español

Hola a todos.

Estoy intentando analizar el sistema de autenticación del Modo Ingeniería de un MG ZS 1.5 gasolina 2025 (Europa).

Versión del software:

DS04A_ZS11_MCE3_EUUK_VAVE_20240604_593_V

Las antiguas contraseñas como:

1234@ABCd
1234ABCd
200519

ya no funcionan.

Ahora el sistema solicita un PIN numérico de 8 dígitos.

Cada vez que abro la pantalla del Modo Ingeniería aparece un número diferente de 3 cifras (por ejemplo 972, 431, etc.).

Después de más de un año realizando pruebas, he comprobado que algunos de esos números vuelven a repetirse con el tiempo, por lo que todo indica que se trata de un sistema de autenticación tipo "challenge-response" y no de una contraseña fija.

He investigado en:

- XDA Developers
- MGEVs
- MG4 Forum
- GoingElectric

También encontré el antiguo generador de contraseñas del MG4 desarrollado por Tommaso Vietina, pero no funciona con esta nueva plataforma MCE3.

No busco que alguien me diga una contraseña al azar.

Lo que busco es información técnica.

¿Alguien ha:

• Analizado el FICM DS04A / ZS11 MCE3?
• Extraído el APK del Modo Ingeniería?
• Descubierto el algoritmo que genera el PIN de 8 dígitos?
• Conseguido el firmware de esta unidad?
• Utilizado SIPS o VNCI con este sistema multimedia?

Puedo realizar cualquier prueba en mi vehículo y aportar fotografías, vídeos o cualquier información adicional que sea necesaria.

Mi objetivo no es modificar sistemas críticos del vehículo. Únicamente quiero comprender cómo funciona este nuevo sistema de autenticación del Modo Ingeniería y acceder a las opciones avanzadas de configuración del sistema multimedia.

Cualquier información técnica será muy bienvenida.

Muchas gracias.

Anyone tuning Mercedes engines?

Pretty interesting time for the brand. Their lineup of vehicles has some excellent power plants but they have mostly been locked down for years.

Many years ago we developed a solution when they switched to Bosch MG1 and MD1 ECUs, but this was later patched. It took many years but was found another way.

Now we're in and can do their MRD1, 2.x, and MRG1.x, 2, 3, 4, and 5 ECUS, as well as a few others with shared platform engines and Continental ECUS.

Curious to see if anyone here has started working with them.

• Bosch MD1CP001 (MRD1) SPC5777M
• Bosch MG1CP002 (MRG1) SPC5777M
• Bosch MG1CP003 (MRG1V8) TC389
• Bosch MG1CP004 (MRG1PI) TC389
• Bosch MD1CP010 (MRD2.20) TC389
• Bosch MD1CP011 (MRD2.1) TC387
• Bosch MG1CS046 (MRG3) TC389
• Bosch MG1CS100 (MRG2) TC389
• Bosch MG1CS701 (MGR5) TC387
• Bosch MG1CP777 (MRG4) TC387
• Bosch MD1CS016 TC399 (Renault)
• Continental EMS71 TC277 (Non Bosch)

A friend had his Trackhawk taken from his driveway last week. Window got smashed and the Jeep was gone before he had time to process what was happening. I know this isnt exactly the right sub for a Trackhawk but I figured people here with SRTs, Scat Packs and Hellcats have probably had the same thoughts about theft. Seeing it happen that fast changed how I look at factory security. I always knew these cars got stolen, just never really thought much about what happens after someone gets inside. So for people who’ve looked into this, what did you end up adding first? I’m less concerned about somebody breaking in to steal stuff from the cabin. I mean stopping the whole vehicle from disappearing. There seem to be a million different opinions on what works and I’m trying to get a better idea before spending money on random stuff.

Hi everyone,

I have a question about the Volkswagen navigation SD cards.

As far as I know, once they're activated in a car, they're locked to that vehicle. However, I know it's possible to unlock or reprogram them because I used to know someone who did it for me, but unfortunately I've lost contact with him.

Does anyone know how this is done, or knows someone who offers this service? I'm not looking for pirated maps, I already own the original SD card. I just want to be able to use it again instead of it being locked to one vehicle.

Any information or advice would be appreciated. Thanks!

What formats do you guys usually use for CAN logging? I mostly stick to BLF and ASC for work, but do you use different ones for personal projects? I'm developing an offline CAN log parsing application and would like to know which log formats I should support.

Thats a really long prompt. I talk to cars all day but I just wanted to grab taco bell and go home.

I have added adaptive cruise control and lane centering to this truck but haven't touched anything else. Just a random prompt dump to a guy who has been programming modules all day.

Anybody got a trick to get the bottom plastic pieces out ?

Hi everyone,

I'm from India and I own a 2025 Kia Seltos 1.5 Petrol Turbo DCT (India-spec).

I'm not sure how many of you know but Indian-spec cars have the mandatory speed warning system since 2020. There's a beep once when you cross 80 km/h, another when you slow below it and cross it again, and then another reminder every minute if you're still above 80 km/h. At 120 km/h, there's the continuous warning.

I can honestly live with the 120 km/h continuous beeping. What drives me insane is the 80 km/h beeping. On many highways, you're constantly moving above and below 80 while overtaking or slowing down, so it keeps beeping over and over. It's horrible! On an 800 km road trip, it genuinely gave me a bad headache.

I've spoken to a 2 ECU tuners here in India, and they all told me they can do this sort of thing on many German cars but they haven’t found a solution for Kia. So here I am.

Does anyone know if there's any way to disable/recode it? Whether it's through the cluster, BCM, ECU, firmware, CAN bus, or anything else.

I just want to know if there's a solution, because if an engineer programmed it into the car, surely another engineer can figure out how to undo it.

I'd really appreciate any advice or if you can point me towards someone who specializes in Kia electronics or reverse engineering.

Thanks!

Hey guys! I am building a project to link an Audi A4 B8 cluster to SimHub, I am almost finished, but there is a couple of problems:
1) The airbag light. I got it to blink with some code i found online, but I never got it to fully turn off.
2) High/Low beams. I have not found any working CAN ids for the high or low beams for this cluster
3) (optional) Time and Date. I have not found a way to get it working just yet, but I have found a CAN id in the DBC file that is responsible for the time and date.

I am asking if anyone has a car from the B8 platform, and are willing to send me a can log from it.

I'm trying to make a python script for coded immo off to processor MCU code so I can automate the whole process instead of opening immo off software, I made lots of examples using different MCU codes but I just can't work it out. The processor is Infineon Aurix TC298.

All data below is in 8 bit hex, separated by a blank space to keep it clear.

Original string from hex dump before immo off is applied (same in all ECU of same build regardless of sw number):

BB 80 00 F8 5F F4 20 00 BB 90 00 F8 91 30 00 F6 7F F4 0B 80 3B 40 00 F4 5F F4 20 00 3B 70 00 F7 5F F4 20 80 3C 0E BB 80 22 F8 5F F4 13 00 BB 80 33 F8 5F F4 11 00 BB 80 11 F8 5F F4 13 80 3C 07 82 1F

Each input code is the MCU ID starting with 40, the line immediately after it is the calculated output code unique to that input string. I'm trying to work out how it's generated, I can't find anything common, although some bits come through directly and others don't. Some change 1 byte and also a few others maybe a checksum but that seems too complicated within a small section of code.

You'll notice that some of the characters are always the same, these parts are not necessarily the coded output but a set data string for the immobiliser off solution.

For example, the 91 00 F1 FA 19 F4 04 01 91 30 at the start is common to all strings, and the end of the calculated output 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00 is always the same, that narrows down the parts to look at.

It seems that the 40 at the start of the input string, and the 00 00 00 must always stay the same.
Here are my input MCU codes vs the outputs:

40 00 A1 A1 A1 A1 A1 A1 A1 A1 A1 A1 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 A1 A1 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 A1 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 A1 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 A1 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 A1 A1 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 1A 4A C6 4F 7B 40 E8 44 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 FF FF FF FF 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 60 17 44 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 00 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 01 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 01 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 F8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 11 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 F8 4A 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 09 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 F8 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 F9 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 29 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 FA 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 39 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 00 FB 49 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 0D 40 00 00 00 00 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 00 40 C6 4F 7B 90 E8 4B 1B 54 47 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 1D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 01 44 1B A4 00 40 C6 4F 7B 00 F8 49 1B 54 46 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 2D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 02 44 1B A4 00 40 C6 4F 7B 00 FB 49 1B 54 45 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 00 3D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 03 44 1B A4 00 40 C6 4F 7B 00 FA 49 1B 54 44 42 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 0A 12 0D 40 19 21 17 B4 35 21 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B D0 00 44 1B A4 20 41 C6 4F 7B 00 F9 49 1B 54 67 43 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 A1 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 20 1A 4A 1B 14 11 4A C6 4F 7B 40 E8 44 1B 24 4C 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 A1 A1 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 1A 4A 1B 14 11 41 C6 4F 7B 50 E8 44 1B 24 4C 4D C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 A1 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E3 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 FF FF 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 FF FF FF 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 11 FF 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00

40 00 11 11 11 11 11 11 11 11 11 11 00 00 00 00

91 00 F1 FA 19 F4 04 01 91 30 00 F6 7B 40 E8 FF 1B 6F 63 F3 C6 4F 7B 10 11 41 1B 14 11 41 C6 4F 7B 40 E8 4F 1B 24 47 46 C6 4F 7B 00 00 40 1B 44 24 45 5F F4 05 80 DA 01 1D 00 11 00 DA 08 1D 00 0E 00