yashsingh1/xdaforums huggingface dataset:
[Android Head-Units] Canadianbountyhunter:
A little late to the party

Hey everyone, I just got a truck with a DNN991hd. I’ve been trying to see if anyone made a better interface for it and although I read almost 2 dozen pages of this thread and several others I haven’t found anything yet. Maybe it’s out there and you know where I can look thanks a ton
[Android Head-Units] Jaremyhawk:
sorry for bringing up a very old thread..

hey chris i i seem to be having troubles with the exploit when using exploit it shows this

[-] Exploit failed: The following options failed to validate: LHOST.

[*] Exploit completed, but no session was created.

will be trying this exploit on a kenwood DNN 991HD since the 990 and 991hd use the same chip
[Android Head-Units] Jaremyhawk:
after further screwing around with the meraexploit you frogot to add the commands set Lhost (your pc ip)

set Lhost 4444

now the exploit runs

for some reason the prevous owner of this deck updated it to 1.8....... has anyone cracked this fw update? or is there a way to downgrade this unit back to 1.5 or 1.3
[Android Head-Units] Leandro Mantecón:
Can anybody help me. I have a dnn9710bt. And during a repair on my vehicle, the mechanic did not turn off the panel when removing the battery from the car. After that, the control panel went into a loop when restarting, an ERROR message STARTING KW LAUCHER appears ... Even pressing the factory initialization (red button) ... Here in Brazil I did not find the solution. Thank you so much for your help!

My personal email lemantecon@hotmail.com

whatsapp 55 34 99971 5038
[Android Head-Units] juanchi1981:
Hi, I just have to create those files ???

hello, would you help me by sending the files to my mail loku_jes@hotmail.com, thanks
[Android Head-Units] Birra75:
I have DNN990HD which have corrupted ROM. Does anyone have guidelines how to flash fwdn and where to get unmodified ROM for it? Thanks.
[Android Head-Units] reggieguy1:
please i have the same problem with my unit and i spent a whole lot is buying it, please i really need your help i cant just afford to loose it just like that , mine is the DNN990HD, please do get back to me ASAP my email is reggieguy1@yahoo.com
[Android Head-Units] denzfarid:
hai folks long time no see this thread,

Question:

How to update su binary?

problem si supuer user su binary has been outdated and always failed of im update, only in apps superuser but working with terminal

thank you
[Android Head-Units] golgothagecko:
I could use some help. I had to do a factory reset on my DNN990HD, That seems to have gone OK. However, I am unable to sign into the Account Owner process. My username and password checks out, and it works if I use a PC. However, I noticed that the browser on the head unit will not open this URL: https://www.kenwood.com/car/app/kenwood_route_collector/eng/ and trying to sign into my Account Owner returns an authorization error. I don't think it's a network problem as I tried from 2 different networks (mobile tether and home wifi). Any ideas?
[Android Head-Units] Radius118:
For anyone still screwing around with these radios that needs help with corrupted firmware, boot-looping, lost passwords, etc I have a resource to fix all of these issues to point you to.

You will need to either be really good at soldering or have the JST connector to connect to the USB header on the daughter board.
[Android Head-Units] golgothagecko:
I'm capable of soldering. Where is the resource?
[Android Head-Units] Radius118:
Do you need password recovery or complete firmware re-write?

I can help you with the procedure for lost passwords and that does not require any soldering or connection to the OTG USB port.

Firmware erase and rewrite requires help from a 3rd party. He charges for his services since he is a Kenwood factory authorized repair facility.

Let me know if you just need password recovery or if you need firmware erase and rewrite.
[Android Head-Units] golgothagecko:
I was able to reimage my unit, but it will not register an admin account anymore. It appears that TLS1.0 client on the 990 won't connect to their route collector site anymore. They've upgraded their server but didn't upgrade the clients :(

I was hoping for a way to create an admin account so I'm not prompted to push "Guest" each time I start my car.
[Android Head-Units] Radius118:
Unless these radios are registered with the route collector site you have to either push the "guest" or "administrator" buttons every time. It's super annoying. If it is registered and you know the password then you can use the "auto login" feature to bypass that.

However, if you DO have passwords set up on your unit, I strongly recommend removing them. KW is shutting down the route collector site and as of today all services at that site are discontinued. The site will be completely gone by 2025.

If your radio has a forgotten administrator password there is a procedure to reset that I can share. If it does have a password, and you know what it is then I recommend trying to remove it. If it has no password at all then you want to keep it that way due to the issues you've noted with the route collector site, plus the site shutting down.
[Android Head-Units] golgothagecko:
KW really needs to push a final firmware to these units so the experience isn't complete crap. You can't even purchase a new stereo from them right now if you wanted to! (I've looked for a year+ now)
[Android Head-Units] Marlonmo:
Hello guys, I live in Brazil, and I can't find a place to repair my DNN9710BT that is similar to the DNN991HD.

Same Service Manual that I don't have!

I't don't start. Only show the red light, turn on a black screen, fan always on and anything I've tryed is working.

I't don't power the USB light of my USB Flash Drive , them, I think that it's impossible to reinstal the firmware.

Sorry to ask you, but I really need Help.

I've just have finished to pay for it.
[Android Head-Units] XKenwood:
Sorry to revive an old thread, but.................

Another DNN that bit the dust with the lost password issue.

Radius, can you...kindly... help a fellow DNN991 owner bring his radio back to life?

I'm shocked at the wealth of info provided in this old thread. This forum has the best info I've seen on the Kenwood DNN series.

The Kenwood service center guy referenced is from Africa and has gotten quite a few radios back from the dead by erasing and rewriting firmware using internet connectivity.
[Android Head-Units] Radius118:
I have never tried my technique on a 991 but in theory it should work.

See the attached files and the instruction sheet I wrote. Hopefully this works for you.
[Android Head-Units] XKenwood:
Thank you so much for getting back to me on this! I will test this out today and post results good or bad so you can keep building on the knowledge and also help others in the loop what works and what not. Some day this and all other qwerks these DNN units have will be an issue of the past.
[Android Head-Units] Radius118:
No worries. Hope you have success.

The quirks of these units will be an issue of the past once they are all in the scrap bin! LOL
[Android Head-Units] XKenwood:
LoL. I came very close to doing just that today. If I didn't have a softspot for the brand I would have. I'm spoiled on how good this unit sounds. I still have all of my vintage Kenwood from the 90's and wth this HU and it's dedicated processors, once adjusted the sound is just plain awsome.

Anyways, I have two DNN991HDs and I got one of them to work! The second daughterboard did react to the reset somewhat.

The only way I could get these files to boot was to have the longface13 changed to longface14 plus the deletedata and zip folder in a clean USB. It would immediately reboot and no need to wait an hour and no Android image popped up either. took less than three minutes ... I think. The head unit that did not reset properly after a reboot I could only go as far as the PW screen, but not into the main menu. BUT....if I leave the USB inserted and reboot, it will clear the PW screen and go right into the menu like it didn't have a PW but then it reboots again and again and again... until I remove the USB before it reads it again and only then can I use the HU. Once I power off the unit, it will go back to requesting the PW. Frustrating!

It was cool to see them light up again. Is there a remedy for the second unit that failed to clear the PW delete process?

MANY thanks Rad!!
[Android Head-Units] XKenwood:
Also, the HU that did work got into the "System Rebuilding Do Not Turn Off" screen twice before it requested to remove the USB and reboot on its own. The second unit said squat and simply rebooted with the USB inserted up until I removed it and then it worked fine until I turned it off. I could not reset the original PW from the HU menu because it still requests the PW to proceed.
[Android Head-Units] Radius118:
Cool! Glad you got one of them working again.

I am pretty sure my instructions said that renaming the .longface file would be necessary.

Perhaps recheck the instructions I wrote and make sure you follow them precisely. Other than that I don't know. I have not had any 991s to mess around with.
[Android Head-Units] XKenwood:
Yes, your notes stated to change from 13, 14 and that's what got me going. There were changes done to the daughter board (syscom board) from your 990HD to the latest 991HD/992 DNN units. I did the firmware update from 1.0.0 to 1.8 on one of the 991, the second unit would only accept the 1.3 firmware update that belongs to the later 992 model. It seems there were late changes on the running software and syscomboard done from 2013/2014 going into 2015.

Sad Kenwood screwed up using slow, outdated software (outdated even at that time) on these otherwise awesome HU's
[Android Head-Units] Jaca777:
Hello,

I have a Kenwood DNN9250DAB. When I turn it on, the first screen appears with wifi, date and user initial setup (initial setup). I press the "next" button and nothing happens, the touch panel works in that area. Anyone have any ideas on this?
[Android Head-Units] marchnz:
It's not an MTCB device.
[Android Head-Units] Jaca777:
Sorry, but what do you mean MTCB? It is new for me.

The unit has a TCC8801 processor.
[Android Head-Units] fierygt:
Hello, could someone help me with what looks like a corruption problem on the internal SD card. I went to update the DNN990HD with just the factory firmware 'DNN_Ver1.8.0', and now somehow, my garmin software on the unit is not working properly. Everything else seems fine, but the GPS is fubar'd and I can't get it working again. I did upgrade the internal sd card to 16gb...mainly because I also have a 690 and the original sd card got corrupted, and I was able to rescue it, but I was trying to cut that problem off before it happened on the 990. What is weird, is when I put the original sd card back in it, it does the same thing, and the gps doesn't work. How can I restore the GPS portion of the software so it works again? I've tried the obvious factory reset and that doesn't change anything. Sorry, didn't know if I should just use this thread or start a new one for this problem, but here is a photo of what it looks like when trying to load the Garmin software on it:
[Android Head-Units] action4:
Hello,

i bought a uses DNN9230DAB and my problem is, that the orignal Wifi-USB-Adapter W02-5617 was lost and i must push the "administrator" or "guest"-Button every time. I couldn`t make a register because i have no Wifi-connection. What a ****.

The DNN works with Android. Could i use any Wifi-USB-Dongle that works with android? Maybe someone knows a compatible Wifi-Stick or what kind of chip works in the W02-5617 (ralink, Arthereos ect.)

Maybe it´s possible to skip the User-Login-Menu. It´s really annoying.
[Android Head-Units] action4:
So, i connected the Kenwood-Support. If i get a Wifi-connection to access "administrator" it wouldn`t work, because the route-collector website is no longer working. So you could not change the setting to set auto login. Mad,...

Does anyone know how to root this DNN9230 to delete this Menu?

best greetings

action4
[Android Head-Units] Amillio:
Any news? This would be great if this works cause the proprietary stuff sucks
[Android Head-Units] chris.davis925:
It seems that if it's possible to resign udpate.zip then we could modify it's contents and update the kenwood using the Kenwood process.

Is that correct?
[Android Head-Units] donaldta:
Not sure. You guys need someone who has the unit and is competent with that part of Android to test it out. As it is, we know that if the ROM has been altered then it needs to be resigned, just like most Android devices. This would be necessary to inject the modified APK that WonderKin has graciously provided to root the device using the Master Key exploit. However, it doesn't seem anybody from this thread has tried it or at least reported the results. I suspect nobody here has had the gumption or savvy to attempt it, since there are so many tutorials on the web which gives instructions on how to re-sign a ROM. Yet, this thread has been pretty dormant despite the effort from Wonderkin to help.
[Android Head-Units] Amillio:
I think if someone gave me what i needed or walked me through it id do it i have the radio
[Android Head-Units] chris.davis925:
I spent some time trying this out. Let me preface this by saying I work in IT, but have zero knowledge in Android development and only understand the basic logic of how update/bootloaders/roms etc work on devices.

After searching google on the update process, I tried two things:

-Used Kenwood's 1.4 update to drop in the RootMyDNN1.4.apk file in the apps folder using 7zip. I did not resign anything.

-Used Kenwood's 1.4 update and added RootMyDNN1.4 apk to the app folder and resigned the entire update package using testsign.jar method.

On the DNN radio, the update fails on both. With option one it takes a little longer to fail (perhaps once it realizes that RootMyDNN.apk is not expected and or signed?)it's worth mentioning that I changed the update.kw file, as this seems to be the real "update.zip" file. Either way, I tried with placing update.kw at root and also with leaving it in the original zip container.

From what I can gather, I would assume that we actually need to resign the update.zip (or update.kw) file with the Kenwood key, as I don't understand how or why signing with an online method would pass signature detection? But then again, I am new to all this and have zero experience.

Any ideas?
[Android Head-Units] donaldta:
The RootMyDNN.apk should actually be signed as the original Settings.apk from the Kenwood ROM since it is taking advantage of the MasterKey exploit which would allow it to be installed individually. However, since the option to "install from unknown sources" is not available, it does not appear possible to sneak the APK via HTTP. With the "inject by ROM" method, it should require to have the appropriate entries in the various files of META-INF directory for the ROM archive which are created by a keysign tool. Unsigned exploits, like with the Chromecast are not all that common and are usually patched up quickly when found. Hence why the more likely requirement of it needing to be be resigned. Some devices you can get away with the ROM signed (with any key, especially if has a custom bootloader) while most require a specific key, as it seems in this case.

The only other method I can recommend is try seeing if you can use Android Debug Bridge (ADB) to connect to Kenwood unit while on the same WiFi connection. It's kind of a stretch but it is not entirely impossible, the Volvo SCT was open to this method. However, this will require the installation of the Android Developer Toolkit on a computer and some experience using the command line. You might be able to get away with using Craze - ADB Toolkit to test the connection with another Android device, but you would probably need to use "adb install RootMyDNN.apk" to actually install it if available. The command is present in sdk/platform-tools directory btw.

If that doesn't work then you'll need someone with more technical methods to root it, like via JTAG or some sort of hardware exploit.
[Android Head-Units] chris.davis925:
Can anyone out there with more experience step in to help? I am not at all familiar with ADB.
[Android Head-Units] funfactor71:
I have a DNN9230DAB which is in fact the german version of the DNN990HD, it uses the same firmware upgrade files from Kenwood.

I tried t ofind an open port on the device:

mars:~ # nmap IP-OF-MY-Device -T Aggressive -p 1-65535

Host is up (0.0080s latency).

Not shown: 65534 closed ports

PORT STATE SERVICE

58058/tcp open unknown

MAC Address: 00:09:DD:12:44:E2 (Mavin Technology)

Nmap done: 1 IP address (1 host up) scanned in 347.54 seconds

The i treid to open a connection to that port, but nothing worked.

I tried adb to connect via wifi to this port, also ssh, nothing.

With telnet i was able to connect but the device didn't answer to any of my commands.

Regards,

Thomas
[Android Head-Units] chris.davis925:
Putting money where my mouth is - I would be willing to pledge $100 towards someone providing a method to root.
[Android Head-Units] chris.davis925:
I just wanted to bump this. Anyone have any ideas?

Should we start a bounty?
[Android Head-Units] donaldta:
You probably should. If it needs a hardware root, people might not have much incentive to try and find it if the reward doesn't even match the cost of the bricking unit. Also, you'll need to gain attention of someone that is technical enough who would buy the unit to hack it. Most people I've found involved with improving the system in Android head units are more likely to be involved in the lower cost generic Chinese head units.
[Android Head-Units] chris.davis925:
I'll create one now.
[Android Head-Units] aplusmiami:
Port Scan via Wifi

I will try to Port Scan via Wifi in the morning. I found this thread and just purchased the unit. I will see what ports are responding if any. How do I try adb via the wifi? I know how to do it from command line to usb device plugged into computer. I heard there is a Kenwood tech here. Are you given alternate instructions for flashing a dead unit lets say? There was some mention of a 4 pin port on the side of the unit? If you are provided different firmware then what was given to the public maybe there is your door to the unit.

I agree this unit is very kool and the display is awesome. I messed with carpc's for a while however a unit like this would be nice to get root access and customize it. I also purchased the remote displays which are nothing more than locked down tablets.

If there is a developer out these with that is interested in doing something with this unit.. I am in throw some $$$ your way.
[Android Head-Units] donaldta:
Of course you're welcome to try, but I believe [MENTION=5664231]funfactor71[/MENTION] already reported the results of a portscan in Post #88.

The syntax is "sdk/platform-tools/adb connect {ip.address}"
[Android Head-Units] siralsmooth:
I made mention of the 4 pin connector on the right side of the unit. It's located under a plastic clear cover. On the prior units with a windowsCE core os, this was a six pin. My guess is the port is probably JTAG. If I could get my boss to let me"borrow" a unit, I could pull it apart and see where the traces lead, and go from there. If it is USB, chances are with the unit powered up, you could connect just the rx/tx, and see if the computer reacts. Only drawback is if any of those pins have power you could toast something.
[Android Head-Units] donaldta:
Well, it sounds like you know what you're doing. But, if there's anyone else that wants to attempt it but might not be as technical; here is an article, "Reverse Engineering Serial Ports", that describes a way of identifying serial ports. And if you're looking for some awesome tools, check out the Bus Pirate and the JTAGulator.
[Android Head-Units] aplusmiami:
I have access to an extra unit let me see if it is simple enough to tear down. I heard a dnn991 is coming out in March!! It has built in Verizon 4g and a app store that does not look like play store.. The video is on you tube.

What about the LZ-T700 remote tablets can we root these things? I can't believe Kenwood built these. Must be another mfg made them for kenwood. What do i look for.. I see the OS is more open on these.

---------- Post added at 05:12 PM ---------- Previous post was at 05:07 PM ----------

Come to think of it - You are suppose to be able to access this unit as if it where a media server. So there has to be more ports open that originally posted.
[Android Head-Units] aplusmiami:
No ports show up on my test of firmware 1.4..

I am not even sure how you are suppose to be able to access this thing via the wireless. I have the two remote LCD/Tablets and I can not figure out how they see the radio if at all..
[Android Head-Units] donaldta:
Maybe this video will help you understand it better.
[Android Head-Units] aplusmiami:
Actually I figured it out - so it seems it pushes DNLA media out to devices that have a DNLA app running on it.

I watched the video - VERY NICE - more Mfg. should do this.

Shame we can't root this thing to make it more open for development. The new one coming out seems to just offer a few more apps, better LCD (Although the current one is pretty dam good for car use) and the Verizon 4G LTE card built in.

I don't see the point of DNLA Push. If I have a hotspot or tether running, I'll give the people in the back a Galaxy, headphones and Netflix!

Ahh well - I love Garmin Maps - That's why I stick with Kenwood.
[Android Head-Units] donaldta:
Yeah, I think it looks like its filled a lot of garbage bloatware.
[Android Head-Units] chris.davis925:
Awesome to see this moving along.

There is a pledge thread for anyone who figures out how to root. You can pledge here.

aplusmiami - are you still planning testing the four pin connector?
[Android Head-Units] aplusmiami:
I will look at it this week - time permitting. I have to open the open I have and trace the circuit to the chip and then try to figure out what the hell chip it is...
[Android Head-Units] chris.davis925:
Awesome. Keep us posted!

---------- Post added at 07:46 PM ---------- Previous post was at 07:12 PM ----------

Question for you all:

Can we use the Android APK exploit found last year to trick our DNN990HD into installing apps as a trusted source?

See here: http://nakedsecurity.sophos.com/201...re-found-exploiting-code-verification-bypass/

It seems that if you modify a system APK that has a valid signature, and create a second duplicate named entry inside of the APK file, the second file/code gets installed without being checked for a valid signature.

Conceptually it makes sense, but I don't know how to go about testing this. Any ideas?
[Android Head-Units] donaldta:
o_0 That

IS

the exploit that WonderEkin used in the RootMyDNN.1.4.apk from Post #64.
[Android Head-Units] chris.davis925:
Sorry I am late to the game. Like i said, I am new to Android development.

With that in mind, I can confirm (like before) that the DNN doesn't allow installs outside of Google Play.

So, since the only way I can see (without physical tampering) to get the APK to install, we would need to modify update.zip

Does anyone know if Update.zip is hash verified? Or does the Android Update.ZIP install method only verify the APKs and data located inside?
[Android Head-Units] donaldta:
Wait. That implies Google Play is available on this unit? I had thought it was NOT available. If it were possible then you could use a terminal app with "pm install {apk.name}". Btw, do you have access to the Android settings? Maybe there is app installer available there.

It varies on the ROM / bootloader included with the Android device, from your previous feedback on your attempts with the DNN990HD, it seems it specifically requires Kenwood's platform key.

Maybe if someone can pick up a JTagulator, they can easily identify what kind of port it is, and can work with it accordingly.
[Android Head-Units] chris.davis925:
I can buy one of these and try, but I would have no idea what I am doing. With the the assistance of someone I'd be happy to try, unless a more capable forum member wants to give it a shot.