Extracting firmware from generic chinese car headunit. - Page 1
Forum section: electronics / general

author: Crawlie69
author_rank: Contributor
timestamp: November 29, 2021, 08:31:50 pm
content: Hey everyone - Long story short: I want to extract the firmware from my generic chinese headunit. I've done something similar in the past (Well someone smarter than me did it LOL). I've already dumped the firmware from the headunit, and been examining the firmware by the ways i know of.- I've ran DMDE on it (No results)- Ran binwalk on it (Gave a lot of interesting results)- Searched for filesystems (There is definitly one or more of them)- Looked for clues as to what kind of partitions there might be (No results)What i know so far is: The operating system appears to be 'eCos'I'm not entirely sure, because the processor's identification has been washed away, but my guess is, that it is some type of ARM processor.I've found boot sections, uImage headers, and lots of LZMA compressed data.Ultimately the end goal is to replace the boot logo (I've already extracted some photos from the firmware, that i've never seen when using the unit itself, but i haven't found the boot logo so far), but i'd love to extract the firmware totally and have fun browsing around and exploringHopefully someone in here, can help me on my way.Thanks!(I've attached the firmware below.): I have to attach the firmware this way, because the file is too large otherwise :https://easyupload.io/mgdsr0

author: fzabkar
author_rank: Super Contributor
timestamp: November 29, 2021, 11:29:30 pm
content: Attached are the JPEGs that I was able to extract with JPEGSnoop.Image #12 is a welcome screen.Offset 0xB30000 appears to be the beginning of a JFFS2 flash file system. It appears to have 56 files.These appear to be the magic numbers:85 19 01 e0 - 56 hits (file name & attributes)85 19 03 20 - 26 hits (64K boundary)85 19 02 e0 - 257 hits (file segments)After carving it out, you should be able to mount the JFFS2 image in Linux.

author: Crawlie69
author_rank: Contributor
timestamp: November 30, 2021, 02:09:58 pm
content: Hey fzabkar - Thanks for taking a look at itI managed to extract those images as well using binwalk, but what's so odd is that i've never seen any of the images, when using the headunit in the car, and the boot image is the exact one that my previous headunit had (if you remember that), so why and where that welcome screen comes from is really weird.Great stuff with the JFFS2 flash file system - I'll do my best to carve it out, and mount it if i'm able to. Thanks!

author: coromonadalix
author_rank: Super Contributor
timestamp: November 30, 2021, 03:26:10 pm
content: what is the radio model ? the cpu model and or the mcu version in the systems infossome radios have hidden menus with configurable boot menus / logosyou can find some help on XDA forums / android head units

author: Crawlie69
author_rank: Contributor
timestamp: November 30, 2021, 03:49:48 pm
content: I'd love to know as well, but unfortunately there doesnt appear to be any such information within the user interface of the radio, and upon disassembling it, i found that the main processing unit has had it identification washed away. My guess is that this is done to make it harder to tamper with or replicate, by other manufacturers. The model number on the radio says 7013, but theres a dozen different models sharing that model number. Sorry

author: fzabkar
author_rank: Super Contributor
timestamp: November 30, 2021, 04:53:29 pm
content: I found this JPEG in the JFFS2 image (file name = 0.bin). There appear to be 26 more of them (0.bin -> 26.bin). They contain embedded JFFS2 metadata, so you can't just carve them out directly. That's probably why JPEGSnoop didn't find them.Edit:I found a VW logo (1.bin). Is that what you are looking for?

author: Crawlie69
author_rank: Contributor
timestamp: November 30, 2021, 08:09:42 pm
content: Wow great stuff.. I spent the good half of this evening searching for all possible documentation about the JFFS2 filesystem, and tried figuring out how to extract it from the firmware dump. Seems very complicated :/- And yup! The blue image saying "HD MP5" Is the boot logo, which is the exact one my previous headunit also had. Funny. Cool you found a VW Logo as well. I wonder why they didn't make an option to change this boot logo, when they're all within the firmware anyway...I looked at the offsets you provided earlier, and i see strings saying "JFFS2", but i don't understand how one would extract this filesystem, and maybe mount it as well. There must be some way to convert this data into regular folders and pictures, as they once were before they were compiled right?THANKS fzabkar! I truly wish i was as smart as you

author: Crawlie69
author_rank: Contributor
timestamp: November 30, 2021, 08:12:11 pm
content: Sorry for the eagerness LOL. I think i've found a great page describing how to mount the JFFS2 filesystem on a regular linux PC. I think all the documentation i read, made me overcomplicate the procces, because examining your JFFS2 image file, shows me, that you literally just extracted the JFFS2 filesystem from within the firmware image. I think i understand it better now!

author: Crawlie69
author_rank: Contributor
timestamp: November 30, 2021, 10:18:38 pm
content: Ah well. Finally got it working. I noticed there's a lot less information than i wanted. I wonder if it's stored within the JFFS2 Filesystem... Must be?.. Might be in some of those bin files, if they're not all pictures. Examining the files, many of them arent readable so they must be compressed... or something like that?

author: fzabkar
author_rank: Super Contributor
timestamp: November 30, 2021, 11:37:03 pm
content: Nice work!The numbered .bin files are JPEGs. Most of the other files appear to be copies of the same JPEGs. :-?The JPEGs won't open in an image viewer because they are prefixed with a 32-bit size value.Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 00 00 E1 03 FF D8 FF E1 00 18 45 78 69 66 00 00 ..á.ÿØÿá..Exif..^^^^^^^^^^^ *****JPEG size = 0xE103 beginning of JPEG = 0xFFD800000010 49 49 2A 00 08 00 00 00 00 00 00 00 00 00 00 00 II*.............00000020 FF EC 00 11 44 75 63 6B 79 00 01 00 04 00 00 00 ÿì..Ducky.......00000030 46 00 00 FF E1 03 2F 68 74 74 70 3A 2F 2F 6E 73 F..ÿá./http://ns00000040 2E 61 64 6F 62 65 2E 63 6F 6D 2F 78 61 70 2F 31 .adobe.com/xap/1........0000E100 00 00 00 00 07 FF D9^^^^^ end of JPEG = 0xFFD9Edit:I think there are 17 files missing from your extracted list (eg airplay_ROM.bin). :-?In fact all those files with text names and no .bin extension (airplay, android_auto, autolink, etc) should be zero sized files. Maybe these files are confusing your extraction tool?18.bin is compressed. It can be decompressed with 7Zip.2.bin should be a JPEG, but it hasn't been extracted correctly. In fact I think many files have been extracted incorrectly.I think the easiest way to replace your welcome screen with the VW logo would be to swap the names of the 0.bin and 1.bin files. However, you would need to recalculate the CRCs for each file. If you are able to properly mount the file system image in Linux, then Linux should automatically handle the CRC updates after you rename the files ... I think.Edit:Could those zero-sized files actually be directories?

author: Crawlie69
author_rank: Contributor
timestamp: December 01, 2021, 01:16:03 pm
content: Thanks!I just used a script i found which does all the work for you "unjffs2".I'm guessing the mounting operation has gone wrong somehow - I think i'll try mounting it a different way if possible, to see if the results are different.So far the extracted filesystem looks odd to me - There's too much missing, and the extracted files also appear rather weird to me. I think you're right.Thanks for the help so far fzabkar

author: Crawlie69
author_rank: Contributor
timestamp: December 01, 2021, 04:05:20 pm
content: Alright.. So things just got a lot funnier!!

author: fzabkar
author_rank: Super Contributor
timestamp: December 01, 2021, 04:28:38 pm
content: That's better!I have attached your JPEGs.Edit:My first compilation was wrong (I stripped the first 3 bytes instead of the first 4 bytes).

author: Crawlie69
author_rank: Contributor
timestamp: December 01, 2021, 04:35:55 pm
content: Thanks! - Stupid question - How did you convert them to jpegs and how would i convert them back to bin files before remaking the jffs2?- Also weird sidenote. I'm not able to open or view the JPEGS in photoshop, paint or my windows media viewer. Am i doing something wrong?

author: fzabkar
author_rank: Super Contributor
timestamp: December 01, 2021, 05:25:16 pm
content: Sorry, I have repaired the JPEGs. I made the mistake of stripping the first 3 bytes instead of the first 4 bytes. Strangely, PaintShop Pro still managed to display the images.You can re-download the repaired archive in my previous post.

author: fzabkar
author_rank: Super Contributor
timestamp: December 01, 2021, 05:43:40 pm
content: You can swap the 0.bin and 1.bin file names by editing the following bytes:Code:Offset(h) 00 04 08 0C00B30000 851901E0 …..à00B30010 2D000000 3A314D58 01000000 00000000 -...:1MX........00B30020 02000000 A596EF60 05080000 A77004A0 ....¥–ï`....§p.00B30030 74E3AAB4 302E6269 6EFFFFFF tãª´0.binÿÿÿ^^ ^change 0x30 to 0x31 "0" -> "1"Code:Offset(h) 00 04 08 0C00B3E360 851901E0 2D000000 3A314D58 …..à-...:1MX00B3E370 01000000 01000000 03000000 A596EF60 ............¥–ï`00B3E380 05080000 59ADC995 C4CACA89 312E6269 ....Y.É•ÄÊÊ‰1.bi^^ ^change 0x31 to 0x30 "1" -> "0"00B3E390 6EFFFFFF nÿÿÿWhen you mount the edited JFFS2.img file, I expect that Linux will complain about CRC errors. Hopefully the error message will report the expected and actual CRCs. If so, then we can patch the appropriate bytes.

author: Crawlie69
author_rank: Contributor
timestamp: December 01, 2021, 06:18:48 pm
content: Thanks! Dunno if i'll get it sorted out tonight, but will work on it ASAP. Might even try making my own jpeg, and then just replace the boot image, that way i might be able to not swap the bin file names as well. Regarding the CRC, apparently it should be possible for linux to just fix that, but i don't know yetYou'll hear from me soon again - and THANKS for the help

author: fzabkar
author_rank: Super Contributor
timestamp: December 01, 2021, 06:38:24 pm
content: After you create your own JPEG, you need to prefix the file with a 32-bit bigendian dword which reflects the size of the JPEG.The image resolution is 1024 x 600 x 24-bit.

author: Crawlie69
author_rank: Contributor
timestamp: December 01, 2021, 07:03:22 pm
content: I wasn't aware of that. Will do my best - You'll probably hear from me again soon. LolTHANKS

author: fzabkar
author_rank: Super Contributor
timestamp: December 01, 2021, 10:37:16 pm
content: I have decompressed all the ROMs.All but one of the ROMs were encoded using a simple XOR.For example, here is airplay\airplay_ROM.bin:Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 10 4D 4D CD 4D B5 DC 45 4D 4D 4D 4D 4D 4D 33 4DIf we XOR each byte with 0x4D, we get ...Code:Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F00000000 5D 00 00 80 00 F8 91 08 00 00 00 00 00 00 7E 00The result can then be decompressed with 7Zip.

author: Crawlie69
author_rank: Contributor
timestamp: December 02, 2021, 09:57:12 am
content: Nice work! Would love to know more about these roms, and how they're run within the firmware. I also wonder how the rest of the firmware would be extracted. I see boot images (i believe?) and other cool stuff. Doesn't appear to be stored in any weird filesystem format, because a lot of it is readable straight from the firmware dump, but how it would be extracted i don't know yetEdit:Maybe some of the data recovering programs could work? DMDE didn't give me any results, which i find weird because there appears to be lots of files visible outside the JJFS2 file system.. Would love to get the rest 'carved out' just cause.. Why not?Edit:Could the rest of the firmware just be stored in a simple UFS file system? Examining the decompressed roms, reveals unix paths, which appear to be stored outside the JFFS2 file system. The JFFS2 file system pretty much only seems to contain the pictures for boot and roms for Carplay, Android Auto, Apples IAP2, The chinese 'Carlife' and WFD. Seems like they just stacked the JFFS2 file system on top of the existing firmware, which also explains why it's pretty much identical to my last firmware from the user interface.

author: fzabkar
author_rank: Super Contributor
timestamp: December 02, 2021, 04:48:48 pm
content: DMDE (and all data recovery programs) look for file signatures at specific sector offsets. For example, a JPEG file in an NTFS file system starts with 0xFF 0xD8 at offset 0 within the sector. Your embedded JPEGs, on the other hand, are all over the place.There is a block of JPEGs in the eCOS section between offsets 0x33E510 and 0x41DC1D. The preceding data look like graphical bitmaps, but I can't identify the beginning and end of each file. There must be some kind of directory which tells the firmware where to find each file, but I can't see it.You can see the beginning of the first file after the last JPEG. It appears to contain bitmap data (not compressed), but I can't think what image format it could be.Code:Offset(h) 00 04 08 0C0041DC10 00000000 00000000 00000007 FFD90000^^^^end of last JPEG0041DC20 14001100 08000000 CCF34198 14001100^^^^^^^^beginning of next file0041DC30 08000000 20F54198 0E000000 AC004C980041DC40 0E000000 2C004C98 3F000000 A4B05098

author: amyk
author_rank: Super Contributor
timestamp: December 03, 2021, 04:13:34 am
content: LOL @ JPEG #6...Based on strings "8368-U" "8368-U-X" "8268K-WC" etc. found in some of the firmware files, this is probably one of these:https://www.sunplus.com/products/adas.aspUnfortunately, like a lot of SoCs, detailed information on them is hard to find.

author: Crawlie69
author_rank: Contributor
timestamp: December 11, 2021, 10:59:09 am
content: Sorry for the late reply - I've been very busyamyk: - Cool stuff - Seems that i was right in assuming it was some kind of arm processor lol.I've had this happen multiple times, and it kinda makes the reverse engineering process harder, because without any datasheets it's harder to get an idea of how the firmware works in relation to the processor. I thought multiple times about the possibility of running the firmware in QEMU to have a live debugging environment, but i don't know if it's possible or even worth it.fzabkar: Makes sense with DMDE, but i don't understand why it isn't possibe to scan all over the place instead of scanning specific sector offsets? - Maybe i don't really understand how it works. However since it's 99% sure that the firmware is based on some kind of version of eCos, which is open-source, would it be worth it reading the documentation about eCos? There must be a lot of 'default' settings or ways to set up the firmware, hence there must be a way to really debug and decompile the firmware right? Or atleast run it in a live environment somehow. Would love if there was some way to maybe bring up a terminal or console of some kind.Thanks!Edit:After reading documentation about eCos and trying everything possible to extract the kernel and lzo compressed data, poking around the uimage header information, trying to understand the uboot images, etc. I truly think it's too hard to accomplish with the limited information available online, along with my limited knowledge. I think the first goal therefore will be to replace the boot image, and then at some point i hopefully will be able to modify more stuff.Future goals will be to adjust the screen resolution a bit if possible, and modify some of the graphical user interface, as i'd love to modernize it a bit.Edit2:Will start working on replacing the boot imageI think i'll go the more simple route and just swap the existing VW Logo with the current boot image, like u suggested fzabkar. Will let you know how it goes

author: fzabkar
author_rank: Super Contributor
timestamp: December 12, 2021, 08:17:43 pm
content: If you want to use your own custom image, I would mount the JFFS2 file system in Linux, rename 0.bin to w.bin, say, copy your new image to 0.bin in the root directory, and then overwrite the original JJFS2 file system with your modified file system.As for DMDE, it is designed to work with storage devices where files are aligned to sector boundaries. You can specify custom file types with non-zero offsets, though.

author: Crawlie69
author_rank: Contributor
timestamp: December 12, 2021, 08:29:24 pm
content: Hopefully everything works outI had quite the trouble mounting the JFFS2 correctly last time, had trouble when it was mounted probably, because i couldn't get permission to edit or copy any of the files, etc. Will get to it, when im free from work.

author: findyy
author_rank: Newbie
timestamp: February 04, 2025, 09:42:10 am
content: Hi, how is everything going? I met the same problem. I have a Linux head unit which also has a 8368 series CPU and I want to replace the boot animation, too. SO, have u successfully replace your boot image?

author: fzabkar
author_rank: Super Contributor
timestamp: February 18, 2025, 11:48:12 pm
content: Quote from: findyy on February 04, 2025, 09:42:10 amUpload your firmware dump.