12FG service menu

[LONGFLYER]

Originally Posted by petertheb

Dear All,

I want to THANK YOU GUYS for that Magic Card Trick, it is working now perfectly.
I have also 14MZ and 12FG is used for trainer moded with my child, I use to have the problem with throtle stick calibration from 12FG side it was shifted with the ranges some % and causing problems - now IT IS 100% perfectly the same as 14MZ....

Once agani many thanks ...

PB

I'm happy for you!
Good Flights!

[apleichau]

Originally Posted by LONGFLYER

Hi Apleichau, by HEN delete your SD card before follow steps:

- Insert your SD card into PC
- Format SD card (FAT)
- Insert SD card into 12FG
- Turn-on 12FG and format SD card
- Write 1 model file into SD card (It's important to do)
- Insert SD card into PC again
- By Hex Editor Neo make a copy of image SD card
- Send me your copy to m.dellino@gmail.com


Bye!

I once again thank you for your kind assistance so that I can access the service menu.
Have every Good Flights

[LONGFLYER]

Originally Posted by apleichau

I once again thank you for your kind assistance so that I can access the service menu.
Have every Good Flights

Thanks for your comment!
If I can, I like helping people who asked to smile

Have every Good Flights to you too

[ajd999]

Hi All!

First sorry about late reply. I was away for a while. But it looks like you were able to sort things out on different SD cards.

Until we figure out the exact format of the tinyfs filesystem, I think the best way to create the key file, is by creating only one model on the SD card and searching for the first occurrence of the string '54 00 31 00 32 00 46 00 47 00' (i.e. 'T12FG' in unicode) in TINYFS.IMG file. This string is always present at the beginning of the model file. Before there are two more bytes that I believe mark the file type (i.e. 00 01 for heli, 00 00 for airplane...).

So... Search for this string, note the address, subtract two, and enter "T12FG TEST(NORESET)" at that address.

[ajd999]

Hi All!

Was anyone able to figure out, what exactly is being calibrated when you select J1 - J4 at the calibration screen?

The TX shows WIDE->NT, NARROW->NT, WIDE and NARROW. My guess is that this procedure calibrates the dead band around the stick center. I interpreted WIDE->NT as: Move the stick to the right (or down), then back to center (NT = neutral) and confirm by pressing enter.

Has anyone come up with a different or more thorough explanation?

[ajd999]

Originally Posted by jhoexp

Hi guys!
have been waiting for this moments for months, but procedure failed on my tx.

My T12FGH is USA version, 1.6 firmware, 1Gb SD Card.

Wiped out the card, formatted FAT under windows than formatted in TX and created a new model on sd (NEW1)

At adress 00200 read: 43 (all the adresses on the line before and after this are 00)
At adress 02200 read: 02 (all the adresses on the line before and after this are 00)
At adress 06200 read: 10 00 1F 77 93 D9 (repeated at 06280)
At adress 82a00 read: 00 (and all the adresses on the line are 00)

Searched for the strings above and found that:

'54 00 31 00 32 00 46 00 47' start at adress: 83202

What should I do?

Thank you so much!!

You should enter the service menu string 'T12FG TEST(NORESET)' at location 83200. See also the updated instructions in my first post in this thread.

[ajd999]

Originally Posted by LONGFLYER

http://www.baronerosso.eu/forum/radi...ml#post2101218

According to my very limited knowledge of italian language, in post http://www.baronerosso.eu/forum/radi...ml#post2103463 you seem to mention firmware version 1.8beta.

Can you provide any additional info about that?

[LONGFLYER]

Originally Posted by ajd999

According to my very limited knowledge of italian language, in post http://www.baronerosso.eu/forum/radi...ml#post2103463 you seem to mention firmware version 1.8beta.

Can you provide any additional info about that?

Hi Ajd999,

1.8beta version of 12FG firmware adds little (it's from Robbe)

- if you want you can choose a new home page (with two big timers ...)
- you can access to model menu by edit of model name on home page (new and old)
- turn-on put RF ON unless you press EDIT button while turning-on
- perhaps also corrects errors ...

If you want I'll send you ...
Thanks for your first post

[ajd999]

Originally Posted by LONGFLYER

Hi Ajd999,

1.8beta version of 12FG firmware adds little (it's from Robbe)

- if you want you can choose a new home page (with two big timers ...)
- you can access to model menu by edit of model name on home page (new and old)
- turn-on put RF ON unless you press EDIT button while turning-on
- perhaps also corrects errors ...

If you want I'll send you ...
Thanks for your first post

I already found it on the net and installed it. Thanks for the offer though. It seems to be working nicely. The service menu file is also the same as it was before.

[LONGFLYER]

Originally Posted by ajd999

I already found it on the net and installed it. Thanks for the offer though. It seems to be working nicely. The service menu file is also the same as it was before.

Yes, for 1.3, 1.6 and 1.8beta it's the same (access metod and content)

A question: Where can I read more information about the Futaba Tiny filesystem?

[ajd999]

Originally Posted by LONGFLYER

A question: Where can I read more information about the Futaba Tiny filesystem?

AFAIK nowhere. I was able to reverse engineer some of it. Here's what I was able to figure out:

• 0 - Header of the file system: This should contain some info about block size, address of the first block etc. I don't know the details yet.
• 200 - Start of the directory allocation table: I.e. which directory slots are occupied and which are free. If a slot is occupied, there is a file present. One bit per directory slot. LSB first - bit 0 of first byte is the first directory slot, bit 1 of the first byte is the 2nd directory slot, and so on.
• 2200 - Start of the file allocation table: I.e. which blocks on disk are allocated and which are free. One bit per block. LSB first.
• 6200 - Start of directory slots: Each slot is $80 bytes long. Slots 0 and 1 are always present. Their purpose is unknown. Slots 2-4 are used to store firmware. Slot 5 is used to store service menu key file. Slots 6 and on store model files. The meaning of bytes in each slot is as follows:
  • bytes 0-1: unknown
  • bytes 2-5: date and time of the file (in DOSDATE and DOSTIME format). Files created by TX always have 1995/11/23 18:30:50 here. Files created by ffs.exe have the current date/time on the PC.
  • bytes 6-7: unknown
  • bytes 8-11: size of the file in bytes - big endian. Model files have size 755e (firmware 1.6) and 7562 (firmware 1.8).
  • bytes 12-7f: list of blocks used by file - 16bit, big endian, zero terminated. First block on disk is 1.
• 82a00 - First block of data on disk (on my SD card): Block size is $40000. The location and block size varies between different SD cards. I suspect it is somehow stored in the header of the file system.

If you discover anything else, please let us know.

[LONGFLYER]

Originally Posted by ajd999

AFAIK nowhere. I was able to reverse engineer some of it. Here's what I was able to figure out:

• 0 - Header of the file system: This should contain some info about block size, address of the first block etc. I don't know the details yet.
• 200 - Start of the directory allocation table: I.e. which directory slots are occupied and which are free. If a slot is occupied, there is a file present. One bit per directory slot. LSB first - bit 0 of first byte is the first directory slot, bit 1 of the first byte is the 2nd directory slot, and so on.
• 2200 - Start of the file allocation table: I.e. which blocks on disk are allocated and which are free. One bit per block. LSB first.
• 6200 - Start of directory slots: Each slot is $80 bytes long. Slots 0 and 1 are always present. Their purpose is unknown. Slots 2-4 are used to store firmware. Slot 5 is used to store service menu key file. Slots 6 and on store model files. The meaning of bytes in each slot is as follows:
  • bytes 0-1: unknown
  • bytes 2-5: date and time of the file (in DOSDATE and DOSTIME format). Files created by TX always have 1995/11/23 18:30:50 here. Files created by ffs.exe have the current date/time on the PC.
  • bytes 6-7: unknown
  • bytes 8-11: size of the file in bytes - big endian. Model files have size 755e (firmware 1.6) and 7562 (firmware 1.8).
  • bytes 12-7f: list of blocks used by file - 16bit, big endian, zero terminated. First block on disk is 1.
• 82a00 - First block of data on disk (on my SD card): Block size is $40000. The location and block size varies between different SD cards. I suspect it is somehow stored in the header of the file system.

If you discover anything else, please let us know.

Congratulations on your results and If I obtain more information, certainly, I will inform the forum

Thank very much Aid999!

[starmoon007]

following ajd999's hard work, I have successfully get into T8FG service menu, here is the detailed procedure.

1. Get a empty SD card. (zero fill it if nessesary)
2. Insert into T8FG and format the card as prompted.
3. Copy a model to the SD card. (no matter the name or the type it is)
4. power off the TX and put the SD into a SD card reader on your computer.
5. use any HEX edit tool (I'm using ultraedit) to open tinyfs.bin file on the root directory of the

card. (you may need to enable show hidden files on your explorer options).
5.1 make changes to following addressed.
00200: 23 (original 43, or 03 if card is empty)
02200: 02 (original 00 if empty)
06480: 00 00 1F 77 93 D9 00 00 00 00 00 13 00 01 00 00 ( original all 00 or FF )
82E00: 54 38 46 47 20 20 54 45 53 54 28 4E 4F 52 45 53 45 54 29 00 ( stands for 'T8FG TEST

(NORESET)')
* 82E00 maybe different for you card vendor or capacity(I'm using APCER 1G 60x SD card). To find this

address. Find hex string "54 00 38 00 46 00 47 00", (should occure only once if the card was proper zero

filled), the leading two bytes beforce the address occured the match hex string will be 00 00 or 00 01.

(depends the model type you just created or copied in step 3. 00 00 for air plan, 00 01 for helicopter),

at the beginning of 00 00 or 00 01, replace with "T8FG TEST(NORESET)" (note there were two spaces

betwin T8FG and TEST.)
6. Insert the card into T8FG and poweron. you will get into service menu. (don't touch the update switch

besides the SD slot)
7. do some interesting things

*** WARRING !!!! OWN YOUR RISK TO DO THIS, EVERY STEP AFTER STEP 6 MAY DISTORY YOU TRANSMITTER ***

in addtion to 'T8FG TEST(NORESET)' there are following different "filenames" maybe used to enter different service menus.

'T8FG TEST(NORESET)' - Shows all service menus and allows making all the changes.
'T8FG TEST(LIMIT )' - Shows only a sub-set of service menus, with limited editing possibilities. E.g. Cannot change the product id, band, area...
'T8FG TEST(RST SS )' - Don't Known SS stands for
'FX-20 TEST(RST SS )' - Do service FX-20, Don't know SS.
'T8FG TEST(RST PCM)' - Don't Known detail, maybe reset PCM module locate

'FX-20 TEST(RST PCM )' - Do service FX-20, Reset PCM Module.

'T8FG TEST(NOEDIT )' - Shows all service menues, but prevents any changes. Includes an RF test screen.

'T8FG TEST(TELEC )' - Don't known what's purpose
'T8FG SCREEN SHOT ' - A screen shot of TX can be made with SW-H. Screen shots are stored on SD card and can be extracted with ffs.exe tool.

'T8FG TEST SHOT ' - maybe simular to screen shot

[LONGFLYER]

Originally Posted by starmoon007

following ajd999's hard work, I have successfully get into T8FG service menu, here is the detailed procedure.

1. Get a empty SD card. (zero fill it if nessesary)
2. Insert into T8FG and format the card as prompted.
3. Copy a model to the SD card. (no matter the name or the type it is)
4. power off the TX and put the SD into a SD card reader on your computer.
5. use any HEX edit tool (I'm using ultraedit) to open tinyfs.bin file on the root directory of the

card. (you may need to enable show hidden files on your explorer options).
5.1 make changes to following addressed.
00200: 23 (original 43, or 03 if card is empty)
02200: 02 (original 00 if empty)
06480: 00 00 1F 77 93 D9 00 00 00 00 00 13 00 01 00 00 ( original all 00 or FF )
82E00: 54 38 46 47 20 20 54 45 53 54 28 4E 4F 52 45 53 45 54 29 00 ( stands for 'T8FG TEST

(NORESET) ')
* 82E00 maybe different for you card vendor or capacity(I'm using APCER 1G 60x SD card). To find this

address. Find hex string "54 00 38 00 46 00 47 00", (should occure only once if the card was proper zero

filled), the leading two bytes beforce the address occured the match hex string will be 00 00 or 00 01.

(depends the model type you just created or copied in step 3. 00 00 for air plan, 00 01 for helicopter),

at the beginning of 00 00 or 00 01, replace with "T8FG TEST(NORESET)" (note there were two spaces

betwin T8FG and TEST.)
6. Insert the card into T8FG and poweron. you will get into service menu. (don't touch the update switch

besides the SD slot)
7. do some interesting things

*** WARRING !!!! OWN YOUR RISK TO DO THIS, EVERY STEP AFTER STEP 6 MAY DISTORY YOU TRANSMITTER ***

in addtion to 'T8FG TEST(NORESET)' there are following different "filenames" maybe used to enter different service menus.

'T8FG TEST(NORESET)' - Shows all service menus and allows making all the changes.
'T8FG TEST(LIMIT )' - Shows only a sub-set of service menus, with limited editing possibilities. E.g. Cannot change the product id, band, area...
'T8FG TEST(RST SS )' - Don't Known SS stands for
'FX-20 TEST(RST SS )' - Do service FX-20, Don't know SS.
'T8FG TEST(RST PCM)' - Don't Known detail, maybe reset PCM module locate

'FX-20 TEST(RST PCM )' - Do service FX-20, Reset PCM Module.

'T8FG TEST(NOEDIT )' - Shows all service menues, but prevents any changes. Includes an RF test screen.

'T8FG TEST(TELEC )' - Don't known what's purpose
'T8FG SCREEN SHOT ' - A screen shot of TX can be made with SW-H. Screen shots are stored on SD card and can be extracted with ffs.exe tool.

'T8FG TEST SHOT ' - maybe simular to screen shot

Hi Starmoon007, few days ago one friend of mine and I are entered into service menu of T8FG like you (following T12FG method or better ... Aid999 method ... ).

We suggest for first access: T8FG TEST(NOEDIT ) string mode ... it's safer !!!

Well done!
Bye!

[LONGFLYER]

.....

[starmoon007]

I made a little utility help to make a T8FG/T12FG service SD card. (based on futaba's ffs program)

see this post at #2, https://www.helifreak.com/showthread.php?t=222549

(you need to edit KEY.dat to "T12FG TEST(NORESET)" to use for T12FG)

[LOLOTISME]

Hello,i have read your reply and so i have test process but i am very affrad because my t12fg is dead after puting my sd
shure making a mistake
do you think it s possible to save my transmitter or not?
my error i clic an update with a wrong software
thank you for reply
lolotisme

[starmoon007]

I'm sorry to hearing this. i have mentioned NOT to switch the update swicth. The firmware updator programmer does not veriy or checksum the contents that will be flash in to TX.

The only way you could do to recover you 12FG is send to Futaba serivce.

[LONGFLYER]

Originally Posted by LOLOTISME

Hello,i have read your reply and so i have test process but i am very affrad because my t12fg is dead after puting my sd
shure making a mistake
do you think it s possible to save my transmitter or not?
my error i clic an update with a wrong software
thank you for reply
lolotisme

Did you remember to replace microswitch after software updating?

[LONGFLYER]

Originally Posted by ajd999

AFAIK nowhere. I was able to reverse engineer some of it. Here's what I was able to figure out:

• 0 - Header of the file system: This should contain some info about block size, address of the first block etc. I don't know the details yet.
• 200 - Start of the directory allocation table: I.e. which directory slots are occupied and which are free. If a slot is occupied, there is a file present. One bit per directory slot. LSB first - bit 0 of first byte is the first directory slot, bit 1 of the first byte is the 2nd directory slot, and so on.
• 2200 - Start of the file allocation table: I.e. which blocks on disk are allocated and which are free. One bit per block. LSB first.
• 6200 - Start of directory slots: Each slot is $80 bytes long. Slots 0 and 1 are always present. Their purpose is unknown. Slots 2-4 are used to store firmware. Slot 5 is used to store service menu key file. Slots 6 and on store model files. The meaning of bytes in each slot is as follows:
  • bytes 0-1: unknown
  • bytes 2-5: date and time of the file (in DOSDATE and DOSTIME format). Files created by TX always have 1995/11/23 18:30:50 here. Files created by ffs.exe have the current date/time on the PC.
  • bytes 6-7: unknown
  • bytes 8-11: size of the file in bytes - big endian. Model files have size 755e (firmware 1.6) and 7562 (firmware 1.8).
  • bytes 12-7f: list of blocks used by file - 16bit, big endian, zero terminated. First block on disk is 1.
• 82a00 - First block of data on disk (on my SD card): Block size is $40000. The location and block size varies between different SD cards. I suspect it is somehow stored in the header of the file system.

If you discover anything else, please let us know.

Hi Ajd999 and everyone, access to the menu only works for versions up to 1.8beta (included).

CAUTION: The new version 2.0 (downloadable from Robbe by registration) can no longer access the service menu and even the operation of the version downgrade ...