Hacking Podofo 10.26" Android Auto / Carplay - Custom SquashFS format! - Page 1
Forum section: electronics / projects

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 23, 2024, 09:11:09 pm
content: Edit: Now with root access I can modify the files so no need to dive further!I have a 10.26" Android auto screen which is totally useless, crashing every minute or less.Fixing requires you to pay attention to it, restarting bluetooth, connecting phone again... creating a truly dangerous situation on the road, so I removed it on 2nd day with it.The claim date expired and the seller wants nothing with it, so I'm left with another junk device.Although most ICs marking were removed with laser, I noticed a new USB device when shorting the SPI flash Halt pin to gnd, with a description very familiar to me: VID 1f3a, PID efe8... Allwinner FEL mode?Installed Zadig driver, launched xfel and indeed it detected it as a V831 SoC (Though not possible, as this device has external SDRAM, and it's BGA), but V533 / V833 SoCs use the same ID.The kernel shows "v533_t86mp5b_1026_cdr1600x600m35_cpaa_v200b01" so it's must be a v533!This was enough to dump the 16MB NOR SPI flash. Yeah, I could have desoldered it but this was faster and safer.Dump can be downloadedhere.Found the UART connections, there's no uBoot here, but a two stage Android boot?Eventually it shows a login prompt "tina:", suggesting it uses some version oftina Linux.Found this:https://hackaday.io/project/192585-cheapy-rearview-mirror-dashcamcarplayaauto-dev/log/222646-finding-the-root-passwordThe root password was the same, "tc310".I also found this shadow password while grepping "root" to the stuff extracted by binwalk:Code:root:$1$7ceqN2Tq$oWMQfYiVzLYccX59mc7C81:0:0:root:/:/bin/ashHashcat cracked the pasword in less than 30 seconds using a RTX2060 (Write "$1$7ceqN2Tq$oWMQfYiVzLYccX59mc7C81" to hashes.txt):Code:hashcat -a 3 hashes.txtBoot log:Code:HELLO! BOOT0 is starting!BOOT0 commit : 543aaf2board init startset pll startset pll end: bus read error: bus read errorboard init okchip id check OKPOWER SETTING ERROR!DRAM BOOT DRIVE INFO: V0.41DRAM CLK = 792 MHzDRAM Type = 3 (2:DDR2,3:DDR3)DRAMC read ODT off.DRAM ODT off.DRAM SIZE =128 MDRAM simple test OK.rtc standby flag is 0x0, super standby flag is 0x0dram size =128spinor id is: 1c 70 18, read cmd: 0bSucceed in reading toc file head.The size of toc is 24000.bootlogo size: 256, offset: 31744Jump to second Boot.MESSAGE:  TEE-CORE: OP-TEE version: sun8iw19p1_v0.6.0-17-gd754d0e #10 2020年 03月 23日 星期一 01:41:08 UTC armmount: mounting none on /dev failed: Resource busymount: mounting pstore on /sys/fs/pstore failed: No such file or directorystarting pid 677, tty '': '/etc/preinit': Early Setuping virtual filesystem: Got overlay partitions is /dev/mtdblock4Try to mount /dev/mtdblock4 using squashfsTry to mount /dev/mtdblock4 using vfatTry to mount /dev/mtdblock4 using exfatTry to mount /dev/mtdblock4 using jffs2: Uion filesysteminit: must be run as PID 1starting pid 699, tty '': '/bin/mount -t proc proc /proc'mount: mounting proc on /proc failed: Resource busystarting pid 700, tty '': '/bin/mount -t tmpfs tmpfs /run'starting pid 701, tty '': '/bin/mount -o remount,rw /'starting pid 702, tty '': '/bin/mkdir -p /dev/pts'starting pid 703, tty '': '/bin/mkdir -p /dev/shm'starting pid 704, tty '': '/bin/mount -a'starting pid 705, tty '': '/bin/hostname -F /etc/hostname'can't run '/bin/hostname': No such file or directorystarting pid 706, tty '': '/etc/init.d/rcS boot'------run rc.preboot file-----/etc/init.d/rcS: line 118: /bin/hostname: not found/etc/init.d/rcS: line 120: /sbin/mdev: not found------run rc.modules file-----------run rc.final file-----Load mpp modulesflash id: 39260230503571090000000000000000v533_t86mp5b_1026_cdr1600x600m35_cpaa_v200b01hardver: 2ver SWed Jan 1 00:00:00 GMT 2020Populating /dev using udev: donemkdir: can't create directory '/dev/pts': File existsmkdir: can't create directory '/dev/shm': File existslogver: v1starting pid 843, tty '/dev/ttyS0': '/sbin/getty -n -L ttyS0 115200 vt100 'tina login:Ran binwalk, detected some SquashFS filesystems but wasn't able to extract any data.Opened the hex editor and searched for "hsqs" magic signatures, finding three weird squashfs headers.Code:u32 magic [68 73 71 73] "hsqs"u32 inode count [FF 49 98 63] Too much inodes for a 10MB fileystem!u32 mod time [00 00 04 00] Modified 262144 seconds after 1970? Weird.u32 block size [08 00 00 00] The size of a data block in bytes. Must be a power of two between 4096 (4k) and 1048576 (1 MiB), so this is wrong too.u32 frag count [04 00 12 00] No ideau16 compressor [C0 00] ID designating the compressor used for both data and meta data blocks. Should be 1-6!u16 block log [01 00] Log2 of block size. Clearly wrong!u16 flags [04 00]u16 id count [00 00]u16 version major [CA 01] Must be 4. Older SquashFS version are more than a decade old!u16 version minor [00 00]u64 root inode [28 19 6A 06 00 00 00 00]u64 bytes used [87 95 1C 00 00 00 00 00]u64 ID table [7F 95 1C 00 00 00 00 00]u64 Xattr table [FF FF FF FF FF FF FF FF]u64 Inode table [39 7A 1C 00 00 00 00 00]u64 Dir. table [E5 84 1C 00 00 00 00 00]u64 Frag table [1B 94 1C 00 00 00 00 00]u64 Export table [71 95 1C 00 00 00 00 00]Edit:I decided to revisit this, as SquashFS is a read-only filesystem so I can do nothing unless I'm able to modify it.Made a basicSquashfs header parserin Google Sheets, compared to a normal Openwrt squashfs image.After some brainstorming, I came to the conclusion it was very much the same thing, but altering the order of the header struct fields, placinginode countjust beforeroot inode.With this ordering, everything makes sense.Code:u32 magic [68 73 71 73]u32 mod time [FF 49 98 63]u32 block size [00 00 04 00]u32 frag count [08 00 00 00]u16 compressor [04 00]u16 block log [12 00]u16 flags [C0 00]u16 id count [01 00]u16 version major [04 00]u16 version minor [00 00]u32 inode count [CA 01 00 00]u64 root inode [28 19 6A 06 00 00 00 00]u64 bytes used [87 95 1C 00 00 00 00 00]u64 ID table [7F 95 1C 00 00 00 00 00]u64 Xattr table [FF FF FF FF FF FF FF FF]u64 Inode table [39 7A 1C 00 00 00 00 00]u64 Dir. table [E5 84 1C 00 00 00 00 00]u64 Frag table [1B 94 1C 00 00 00 00 00]u64 Export table [71 95 1C 00 00 00 00 00]I modified squashfs-toolssuperblock headerfrom this:Code:struct squashfs_super_block {unsigned ints_magic;unsigned intinodes;unsigned intmkfs_time /* time of filesystem creation */;unsigned intblock_size;unsigned intfragments;unsigned shortcompression;unsigned shortblock_log;unsigned shortflags;unsigned shortno_ids;unsigned shorts_major;unsigned shorts_minor;squashfs_inoderoot_inode;long longbytes_used;long longid_table_start;long longxattr_id_table_start;long longinode_table_start;long longdirectory_table_start;long longfragment_table_start;long longlookup_table_start;};To this:Code:struct squashfs_super_block {unsigned ints_magic;unsigned intmkfs_time /* time of filesystem creation */;unsigned intblock_size;unsigned intfragments;unsigned shortcompression;unsigned shortblock_log;unsigned shortflags;unsigned shortno_ids;unsigned shorts_major;unsigned shorts_minor;unsigned intinodes; // <---- inodes moved heresquashfs_inoderoot_inode;long longbytes_used;long longid_table_start;long longxattr_id_table_start;long longinode_table_start;long longdirectory_table_start;long longfragment_table_start;long longlookup_table_start;};This step is required to build squashfs-tools with XZ compression support (Stackexchange source):Code:sudo apt install liblzma-dev zlib1g-devcd squashfs-toolssed -i 's/#XZ_SUPPORT/XZ_SUPPORT/' MakefileAaaand it's working! The files were extracted successfully. I'm attaching static-linked binaries.Code:Found a valid SQUASHFS 4:0 superblock on /media/c/podofo/mtd2.Creation or last append time Fri Nov 25 11:42:33 2022Filesystem size 7668856 bytes (7489.12 Kbytes / 7.31 Mbytes)Compression xzBlock size 262144Filesystem is exportable via NFSInodes are compressedData is compressedUids/Gids (Id table) are compressedFragments are compressedAlways-use-fragments option is not specifiedXattrs are compressedDuplicates are removedNumber of fragments 13Number of inodes 527Number of ids 1Number of xattr ids 0Code:sudo ./unsquashfs -d mtd2 /media/c/podofo/mtd2Parallel unsquashfs: Using 16 processors449 inodes (399 blocks) to write[=================================================================================================|] 848/848 100%created 351 filescreated 78 directoriescreated 97 symlinkscreated 1 devicecreated 0 fifoscreated 0 socketscreated 0 hardlinks

author: amyk
author_rank: Super Contributor
timestamp: June 23, 2024, 10:05:44 pm
content: Could be an older version of SquashFS.

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 23, 2024, 10:23:48 pm
content: I don't think so!Anyways I triedfirmware-mod-kit, which tests several Squashfs versions, all returned "Wrong version".Edit: Found it to be a custom header! Working now

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 01, 2025, 04:28:17 pm
content: Update here. If anyone else bought this useless trash, this firmware from other vendor fixed it all:https://carplay.tw/blogs/firmware-update/rx10-firmware-update-due-to-ios-17-2

author: rsaxvc
author_rank: Contributor
timestamp: April 14, 2025, 05:43:04 pm
content: Where did you find the UART pins? I might be looking at a different PCB version

author: rsaxvc
author_rank: Contributor
timestamp: April 14, 2025, 08:10:45 pm
content: On mine, UART was 3 round test points near the radio chip.

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 14, 2025, 08:21:04 pm
content: Those where the test points for my device.

author: coromonadalix
author_rank: Super Contributor
timestamp: April 14, 2025, 09:21:35 pm
content: wow very good detective work kudos

author: chriswil77
author_rank: Newbie
timestamp: May 23, 2025, 04:15:24 pm
content: can you share in a bit more detail how you dumped the firmware please. Did you short the SPI flash Halt pin to gnd then connect through the USB port with xfel? I have accumulated quite a few firmware files for these devices but need an exact dump from my own as a backup before i start decompiling and disassembling and playing about with firmware files to flash. I have a ttl -> usb device I can connect through UART but if its just a case of grounding the halt pin and dumping through the devices power USB port it would be much easier.

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 23, 2025, 05:17:35 pm
content: CheckFEL mode and driver installation.Only do the Manual Zadig installation part.The FEL button is the same as shorting the HALT pin to ground, needs to be done everytime before plugging the device in, with the device off!So, simply make the short, connect to the computer through USB, the computer should detect something, release the short.If you keep the short, you won't be able to access the flash.The driver only needs installing the first time, or if you change the USB port.Once the driver is ready, you can run the xfel commands.With the device off, short the pin 7 (HALT) to ground, can be done with some tweezers between pins 7 and 4.In my case, I did a small hole, glued a push button and soldered some wires to the pins.Connect the USB to the computer, after some seconds a new USB device will appear.Remove the short, installZadig Driver.Note: This only needs to be done the first time or if you change the USB port.- Options: List all devices.- Choose the device with USB ID 1F3A EFE8- Click Install driver.DownloadXFEL Utility.This tool only works in FEL mode (Bootloader mode for AllWinner devices).Detect the flash. If detected, you can proceed with reading/writing.Code:xfel spinorBackup. Replace 16777216 (16MB) with the correct flash size if different.Code:xfel.exe spinor read 0 16777216 read.binWrite:Code:xfel.exe spinor write 0 file.binCycle the power afterwards to resume normal operation.

author: chriswil77
author_rank: Newbie
timestamp: May 24, 2025, 08:54:46 pm
content: Thanks for that explanation if anyone wants some of the firmware’s I have to look at I will create a link to them. Most of them when unpacked have a board if of “tccdr=v533” some have them have board “tccdr= v851” so wonder if these firmwares are usable on both different device chipsets

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 24, 2025, 10:19:19 pm
content: I doubt they're compatible at all. Where did you get the firmwares? Would be interesting to try them out.

author: chriswil77
author_rank: Newbie
timestamp: May 24, 2025, 11:06:22 pm
content: I scoured the internet for a few of them and got a couple from different manufacturers (after a lot of badgering and a reluctance from them). All the different brands seem to use the same pcb and chips from looking at the internals from fcc reports. This one is from spedalhttps://spedal.cc/html/en/download-sp/Navicam-CL518.htmlit contains 16gb img file, phoenix tool and video tutorial. You can unpack the img file with android customizer tool??? (Sorry I forget the exact name) but can post the tool with the other firmware I have tomorrow when I can get to my desktop

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 25, 2025, 12:22:03 pm
content: 16GB? Definitely not the same device as this one, seem to be a full android device.The cheap ones are 16MB and are dumb devices, they depend on android auto / carplay for the fancy stuff.

author: chriswil77
author_rank: Newbie
timestamp: May 26, 2025, 11:40:52 pm
content: Sorry my bad meant 16MB. They are mostly all based on the same T86_v231 pcb. I have dumped and extracted my firmware using binwalk, I can see there is a way to change or add custom wallpaper, icons and sound etc I’m just trying find a way to turn my spi dumped binary into an image file that can be flashed to sdcard with phoenixcard for an easier way to update and distribute a custom firmware. Any ideas? Is there any way to read the partition table and get partition size/type etc from the flash dump or is it possible through uart to dump individual partition’s

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 27, 2025, 06:41:13 am
content: Much easier, just flash it witt the tool, then read it back using xfel.

author: chriswil77
author_rank: Newbie
timestamp: May 30, 2025, 12:35:57 am
content: Few firmwares if anyone wants to poke around with them.https://www.dropbox.com/scl/fo/0sc8hwth3ynslrzycdp5e/ALkbw7nyNIRNURcOQar7vKc?rlkey=s38vqt3zpg9ciyg6bufnnjw9d&st=15k6otyy&dl=0Img files can be extracted with ImgRepacker.exe (google) to .fex (bin) files where you can change boot logo etc and repack with ImgRepacker.exe back to img file to flash with phoenixcard tool (I have tested and it’s working). Squashfs can be unpacked with DavidAlfa’s squashfs-tools (above). Going to try get a terminal running, ssh or maybe DOOM 😂. Anyone clever enough to write a better UI for this thing or suggest a way to add some new little apps to make this thing a bit more fun/usefull? Standalone OBD2 app or something so it doesn’t have to rely on being connected with the phone

author: wildtree
author_rank: Newbie
timestamp: June 06, 2025, 09:29:54 am
content: I stumbled upon this thread when trying to read the firmware from another cheap CarPlay screen, in my case it's a 7inch device with an Allwinner V853 inside. I can get you board pictures if needed.For context, I want to modify the firmware because it's misreporting the screen res to CarPlay, resulting in a slightly stretched image. I messaged the seller, but my hopes aren't high.The trick with shorting the halting pin on the SPI works, I can see the device in FEL mode and both xfel and sunxi-tools can read its version, chip etc.However as soon as I do anything past the version - xfel spinor, or xfel ddr, whatever else - the board seems to hang and stops responding to any queries. It doesn't disconnect, as it's still in FEL mode, but all communication times out (xfel prints a usb_bulk_send error).I tried with both xfel and sunxi-tools (the latter had a WIP merge request on GitHub which added support for this chip). Same problem with both, and I tested on two separate machines (Windows and macOS).Have you maybe heard of a similar issue anywhere? I'd appreciate any bits of advice.

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 06, 2025, 11:45:50 am
content: Try using a USB 2.0 port.

author: wildtree
author_rank: Newbie
timestamp: June 06, 2025, 02:27:15 pm
content: Thanks, but unfortunately that made no difference. I tried a few different cables too, for what it's worth.

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 06, 2025, 08:27:16 pm
content: I have no idea, maybe the support for that SoC is bugged.Alternatively, you can buy a cheap CH341 programmer in Aliexpress and read the chip.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: June 07, 2025, 09:07:35 am
content: is the files and guides here usefull to youhttps://v853.docs.aw-ol.com/en/study/study_5flash/they mention a hidden option via uart, if you can find the uart on your board then you can jump to bootloader by sending '2' repeatedly on power updarkspr1te

author: wildtree
author_rank: Newbie
timestamp: June 07, 2025, 07:49:26 pm
content: Quote from: darkspr1te on June 07, 2025, 09:07:35 amAs far as I can see that's useful when you can't access the bootloader at all. In my case that goes perfectly fine, but only later hangs when a read is attempted, so this probably won't help me. Thanks anyway!Quote from: DavidAlfa on June 06, 2025, 08:27:16 pmI have ordered a CH341, waiting for it to arrive now.However I have a new theory. Despite the board reporting itself as an V853, it has 'F8' clearly written on the chip. Could it be misreporting, and in reality be an Allwinner F-series chip? That would check out with some other cheap car screens/radio I've seen online.I'm attaching a photo of the board. Note the F8 on the chip, as well as 'F801' on the board. Google / image search doesn't find any matching SoCs, though.Has anyone seen such a marking anywhere else? Could it be a no-name clone that pretends to be Allwinner?BTW let me know in case this should be a separate thread.

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 07, 2025, 09:03:45 pm
content: Seems like a relabeled chip so it can't be easily identified.

author: chriswil77
author_rank: Newbie
timestamp: June 08, 2025, 04:25:22 pm
content: from looking at your picture i woulds say its more likely the chip is Allwinner v831 (qfn88 -88 pin package) as aposed to the v853 as the v853 is a 318 pin LFBGA package type. Maybe if wont dump as xfel is identifiying it wrong

author: wildtree
author_rank: Newbie
timestamp: June 08, 2025, 05:00:32 pm
content: Thanks, you were on the right track. I managed to dump a small part of the SPI memory (my CH341 clip is shit, and I don't have tools to desolder the chip either), just enough to find out that it's aV837S(v837s-f801u8_102). I'll try to find time to implement support for it in xfel, but I'm not sure how well that will go.(if I manage to find the datasheet...)

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 08, 2025, 06:54:27 pm
content: I have no idea about it. Maybe ask in xfel repo?

author: DavidAlfa
author_rank: Super Contributor
timestamp: July 03, 2025, 11:42:49 pm
content: If you're still trying, have a look at this programming probe:https://www.aliexpress.com/item/1005006774092607.html

author: wildtree
author_rank: Newbie
timestamp: July 05, 2025, 07:59:48 pm
content: Thanks a lot for that link, this would've been amazing to have. Unfortunately, the time came to embed the screen in my brother's car and I didn't have enough time to buy another clip or try anything else. Aside from the bugged resolution, it works quite well. I'll keep you posted if I ever get the screen back for more investigation or if the seller decides to send me a firmware update.