yashsingh1/xdaforums huggingface dataset:
[Android Head-Units] pdanders11:
Sorry, this picture sucks. I'll get you a better one tomorrow.

But this group of resistors are near the Boot Mode pads of the chip. From what I read, FWDN mode is normal entered on telechips devices via a switch on the board. In this case there is no switch just pads for a unpopulated resistor to change a Boot Mode pin high to low (or visa versa) don't remember).

So in the red box, there should be a empty pad with a trace to the cpu. The trace to the CPU with be high and the other pad will be low (or visa versa). This mod can be safely testing using a 1K Resistor or some value to over drive what is on the board. I'll double check the values but a short is OK. I've verified it's a input.

Anyway with the unit off, short the missing resistor and turn it on. The Boot pins are just read at startup so that's why a switch works also. The LCD will NOT come on. the fans will power up and the USB should wake up looking for the FWDN SW on a PC to download a boot file. If no boot file is provided, the unit turns off in 10-20 seconds.

I'm not sure how valuable this will be to you other then to tell you if you USB is still good. We don't have the files need for FWDN mode but it's a interesting thing to know and read up on. If you read up on Coby telechips tablet, they talk FWDN mode lk.rom, boot.rom, etc. I think it would be neat to create a FWDN image but not there yet if ever. The teleschips SDK is floating around out there and has more info. Whether we could mix telechips source code and the SDK's image is probably a long shot. Maybe DD'ing the images in a terminal on the device we could pull the images. Not sure.

There is a newer SDK that is leaked all over the place. Not what I think we want with the old chip but got lucky and stumbled onto the older SDK with ANdroid 4.0.4. Again probably not the #1 thing if we can get shell over wifi and start rebuilding. I like to figure out stuff like FWDN mainly incase I brick a board, it may bail me out. As would JTAG.
[Android Head-Units] pdanders11:
I have no idea how I came across this website. Open it in chrome and let it translate to engish. Seemed the Kenwood needed the VTC drivers tweaked it to install

http://www.answers-base.ru/kak-izmenit/adaptaciya-drajvera-pod-svoe-ustrojstvo.html

Nothing we haven't done forcing adb drivers but for some reason it was interesting to me.
[Android Head-Units] aplusmiami:
What pads did you short that got your USB back? I just want to verify what I am shorting.
[Android Head-Units] chris.davis925:
Hi all,

I will be making available a root method that everyone can use and download later today.

In the meantime, can anyone offer up a FTP/HTTP server that has a dedicated IP address to host the files?

Note: it must be a FTP/HTTP server with a dedicated IP address that can be reached using that dedicated IP address. Not just via DNS.

---------- Post added at 10:04 PM ---------- Previous post was at 09:40 PM ----------

You are correct in that it appears this is being handled via software. To make things worse, in my testing it seemed that this was actually dynamically killed by Kenwood after the OTG discussion started on this thread.

This is why I was asking people to post their boot version and kernel version from the Kenwood "Version Information" app that is hidden in the unit. I was trying to make a link between version numbers and OTG ports getting disabled.

At any rate, applying the root during the update process actually resulted in me bricking two units and getting inconsistent results, even when OTG was working. I suspect this has to do with a combination of the update overwriting/ interrupting ADB Push commands and also that Kenwood has a various checks to see what is present on the system partition.

Not sure if you have noticed this yet, but often when you push something via the update you will see something like ***SYSTEM PARTITION HAS BEEN MODIFIED!** logged several times at boot. oddly enough, it's the first thing it logs, which makes me think this check goes pretty deep.

None the less, the method I will posting later today takes care of this.
[Android Head-Units] mremo:
That's awesome, I hope you get it all sorted out. It's about time they start making stereos with android. Stereo systems have been falling behind for quite a while with their laggy touch input and ridiculous menus
[Android Head-Units] pdanders11:
[MENTION=5909218]radux.m.dan[/MENTION]

When you get shell are your binaries executable? Mine are not. Are you seeing this?

---------- Post added at 01:46 AM ---------- Previous post was at 01:42 AM ----------

In post

http://xdaforums.com/showpost.php?p=53386822&postcount=409

there are two vertical resistor pads circled. The left is is installed the left is not (even the pad is tore ). I short the empty pads on the right.
[Android Head-Units] aplusmiami:
Wow... unexpected Chris thank you.

---------- Post added at 05:21 AM ---------- Previous post was at 04:27 AM ----------

Yep

That is what I am shorting... Well since Chris seems to be working with us again (YEAH!)!! I think we need to work the web exploit and get this thing rooted and at a point where we can start looking at making it a better unit. Hopefully other developers want a nice stereo running android that can be tweaked!
[Android Head-Units] chris.davis925:
[MENTION=2301266]aplusmiami[/MENTION] - there is nothing left to work out. You will find that what I posted will supply root for the DNN990HD and DNN770HD.

I would like to suggest / ask if someone could spend the time developing a CWM recovery image.This will allow us to more aggressively modify the unit (for things like UI, Speed, and start up) without worrying about bricking the unit.

From what I can gather, the recovery image and boot image are not separate and appears to implemented similarly to "Samsung" phones.
[Android Head-Units] radux.m.dan:
Hi Chris!

First of all thanks a lot for sharing!!! Great work.

I went to the point where I actually made some static links in ramdisk to busybox that is already found in system/xbin... now I just need to use the super user app that you shared.

Thanks and regards!
[Android Head-Units] radux.m.dan:
Hi Chris!

I confirm I now have a rooted unit, I used your files and everything went fine. To remind, my unit is EU version DNN9230DAB and my FW version was 1.4.0.

I'll try to find a server with static IP to make this available on the internet.

Cheers!!
[Android Head-Units] chris.davis925:
Great to hear!
[Android Head-Units] aplusmiami:
I have access to a vm box and rack with statics lmk if I can help
[Android Head-Units] chris.davis925:
Can you setup an FTP server with a dedicated IP and send me login credentials to it?
[Android Head-Units] chris.davis925:
For those who have USB OTG working - can you please perform an update and do the following command?

adb pull /snapshot C:\SomeDir

I am seeing references to a /snapshot partition that is not mounted in normal boot.
[Android Head-Units] aplusmiami:
I am going to have this server up on a VM hopefully tomorrow.
[Android Head-Units] Labgate:
Hi

Chris did implement this root on my unit and it is working fine.

I did install nova as a shell and go from Kenwood shell (for radio and phone) to nova. this works very well.

I notice that some apps gets disabled after one or a couple of reboots. For example the Siriusxm app.

If I reinstall the app this works.

You have to put audio in usb audio for audio from regular application to work

there is not so much space available. I'm already low on space. Well chrome take 75Mb of space so I will probably uninstall it but it would be nice if we could install on the sd card.

boot time takes a little bit time to load

It's not always easy to find an apps that looks good because of the resolution and having an horizontal display. I did install rotation manager to force some app to work horizontally but some have not been written for that (example siriusxm and tunein radio)

But overall, this is a great step and will evolve when Chris relases its apps to control sound and block Kenwood to disable some apps. I'm very happy, this unit should have been like this since day one.

I'm anxious to see how to goes. Thanks to everyone. I'm no coder but if you need someone to test I'm available. I have a DNN770HD.

Greetings

Labgate
[Android Head-Units] pdanders11:
After taking a few days off from this I started up again and have the following notes

- The instructions provided forget to set the LHOST variable

- even with that set, I get shell but nothing is executable

- the URIPATH variable is not clear to me. Is that random or pointing to the exploit payload?

- if your getting a lot of hangs on browsing to the exploit, make sure the firewall on the server has the correct port open. I messed around with iptables some before finding Ubuntu has a firewall called ufw.

quick thing to try is

sudo service ufw stop
[Android Head-Units] chris.davis925:
-You don't need the LHOST variable, since you will navigate on your local LAN and the LAN IP is assigned by default.

-Did you set the URIPATH?

-URIPATH sets the current dir to execute from

-You cannot make any changes to the deck since it's locked down and the very nature of the exploit is to unlock it. If we had shell to the unit in the first place, we wouldn't be doing this.
[Android Head-Units] pdanders11:
, ,

/ \

((__---,,,---__))

(_) O O (_)_________

\ _ / |\

o_o \ M S F | \

\ _____ | *

||| WW|||

||| |||

Taking notes in notepad? Have Metasploit Pro track & report

your progress and findings -- learn more on http://rapid7.com/metasploit

=[ metasploit v4.9.3-2014061801 [core:4.9 api:1.0] ]

+ -- --=[ 1316 exploits - 795 auxiliary - 223 post ]

+ -- --=[ 341 payloads - 35 encoders - 8 nops ]

+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

msf > use exploit/android/browser/webview_addjavascriptinterface

msf exploit(webview_addjavascriptinterface) > set URIPATH kroot

URIPATH => kroot

msf exploit(webview_addjavascriptinterface) > exploit

[-] Exploit failed: The following options failed to validate: LHOST.

msf exploit(webview_addjavascriptinterface) >
[Android Head-Units] chris.davis925:
Ah, are you using Kali Linux?
[Android Head-Units] oxman504:
Decrease boot time right?
[Android Head-Units] chris.davis925:
My bad you're totally right. ^^
[Android Head-Units] oxman504:
Yeah because we don't need no stinking longer boot times. Lol.

I'm still holding off from rooting until yall get somethings squared away. You know make it idiot proof. Even then yall might need to hold my hand, because all this stuff is beyond my comprehension.
[Android Head-Units] pdanders11:
I guess if you want to clear the air, I'll give my 2cents.

I think this was a pretty clear statement you were not coming back.

From Kenwoodforums.com

chris.davis925 wrote:

Best wishes to everyone on XDA on figuring out a root process!

I will not be contributing any further to those efforts.

Update: I should probably clarify that I

am not contributing to any efforts on XDA

in particular, but I am happy to help explore further hardware root processes elsewhere.

For those who are interested, I will still consider to provide the root as a service since I do not believe there is an automated way to do this.

I will post some videos and status updates of further development when I get the time.

I'm not sure how you expect people to take that with regards to your comments

So I call BS here.

One the OTG exploit, you made yourself judge, jury and executioner. That is not you job. If I want to go down a dead end, that's my right. You witholding key pieces of get in over OTG that was discovered on this forums was not right. There is a post where you and [MENTION=2301266]aplusmiami[/MENTION] go off to skype to review OTG wiring. In your OTG testing did you discover +5V didn't run to the OTG connector? If so, why was that not shared. As [MENTION=5389783]donaldta[/MENTION] seemed to duck out soon after remoting into you pc and getting root. That seemed odd. Regardless the timing of pushing he build.prop was indicated to be provided but never was.

Whether this was a oversight or you moving on IDK.

Then you clearing break the rules of asking for money up front. I don't care if you knew the rules or not. If your going 55 in a 35, not knowing the speed limit is not a defense.

Mods get involved and your quote above is posted on kenwoodforums. You also posted you were looking for developer to work off XDA. That's fine and dandy but don't come back here all shocked to see people question you intentions before, during, and after these events.

Then to top it off you are asking for an apology for "skewing the facts". Uh, not gonna happen. I did nothing wrong.

I will agree with you "arrogantly saying" blah blah blah. The problem is you come across as arrogant in many of your posts. I know we all aren't IT security professionals, but we do have lives and jobs of our own. Some even more important to then IT security.

In the end XDA is what it is. Everyone brings and contributes what they can. You may be able to root the receiver but I may be able to restore your bricked boards as another way to recoup you losses.

I know your a have to 'get the last word in guy' but that's all I'll say on the topic. I won't speak for others but you lost a level of trust that needs to be rebuilt and this post certainly wasn't step 1.

Yes, releasing your root method was a great step but it doesn't cleanse you of everything that lead to this point.
[Android Head-Units] chris.davis925:
The root is fairly "perfected" - meaning root is not being lost. If you are looking to just install an app or two (like Spotify) then I'd say it's fairly safe for you to give it a shot now.

In fact, the main thing I do now with the unit is use Spotify - so I guess it just depends on what you are looking to do.
[Android Head-Units] aplusmiami:
USB OTG - failure two more units - Linux host

I got my hands on two defective units and swapped my daughter-boards and the SAME thing Unknown device on USB otg.

Changed cables and tried it on a laptop - NO GOOD!

Leads me to believe they somehow have sent out a bullet to shut this port down?

I don't know the history of the two units but I imagine they where at some point connected to the internet or flashed?

I was going to setup a Linux host with the root chris has provided unfortunately I do not have enough hard drive space on the VM server. I thought I could use the software raid on the Mobo to add more space but ESXi does not support software raid. I ordered a Adaptec Raid controller that should be here by friday I HOPE!
[Android Head-Units] radux.m.dan:
Hi!

If you need to install many applications and you don't have enough space left there are two options:

1. Use and SD card in the front of the unit and keep it all the time inserted.

2. Open the unit and replace the microSD that is used to store the maps for Garmin.(default is 8Gb, can be replaced with 16Gb or 32Gb)

Next thing to do when installing an application is to use ADB and use the pm install command and add the option to install on a different location, like the external SD card or sdcard2 which is the internal one for Garmin.

Hope this helps.

Regards!
[Android Head-Units] pdanders11:
I've been toying with this using the mnt2sd app but it looks for the external sd card at a mount point of "sd-ext" or something. I've had a hard time getting the front SD card to mount. I get a format error when I insert the card, I tell it to format, and it hangs. Maybe I'm not waiting long enough. Do you know what filesystem the receiver wants to see on the front SD card so I can format externally? I've tried ext4 and fat but it still seems to claim there is a error on the disk and insists on formatting.

Touching the Garmin card scares me. We should probably recommend "dd"ing that disk before doing much with it so they don't accidentally blow away NAV

---------- Post added at 04:09 PM ---------- Previous post was at 04:00 PM ----------

I've got my Kenwood connected to a Access Point through a PC using Internet Connection Sharing. Running Wireshark and capturing traffic. No "phone home" that I see yet.

I'm still running ADB over OTG. I have Droid SSH installed for normal tasks. ADB comes and goes as the wind blows. it's bizzare.
[Android Head-Units] mike2246:
not working, not sure what part I'm doing wrong but I get to this step and i'm not sure if it's an error or not

busybox tar -x -f kroot_temp.tar -C /ramdisk

after this it says "short read"

after kroot it says segmentation fault

and test for root says unknown uid 10003

I can see the FTP files come across to the device.
[Android Head-Units] chris.davis925:
Sounds like corrupt download.
[Android Head-Units] golgothagecko:
Ipod app?

Has anyone found a better ipod app to replace the factory version?

Regarding the onboard SD card - yes you can back it up and replace it with a 16GB card. See this post:

http://www.kenwoodforums.com/viewtopic.php?f=37&t=4283&sid=539b6847bc8127bbb8518217d8fda2d9
[Android Head-Units] mike2246:
GOT ROOT!!! Thanks

I have a FTP Server up and running if you would like the link, let me know.

Also is the KWAudio going to fix when using Spotify the audio doesn't seem as loud as when using Radio? along with the work around I found that works is open Aupeo and then Spotify and it works.

Also is it normal that even before trying any of this KWLauncer and Multimedia Crash at least once a day or once every other day?

If I'm on 1.4 is it safe to upgrade to 1.5 or should I stay on 1.4?
[Android Head-Units] mike2246:
What Apps are you using?

What Apps are everyone using on their Rooted Device?

I'm currently using the following

Spotify

Dropbox

Root Explorer

Going to Try Torque Tomorrow and link with my OBDII Bluetooth device to see all my Gauges on Radio instead of phone

Also, going to try my unlimited skip Pandora and see if it'll install over top of current one or in addition to.
[Android Head-Units] aplusmiami:
I was on 1.5 when the radio was rooted. Nor sure what will happen if you upgrade after root. I would think you would lose it.
[Android Head-Units] mike2246:
Any benefit from 1.5?
[Android Head-Units] aplusmiami:
I've been so focused on getting my USB working I really never messed with 1.4.
[Android Head-Units] chris.davis925:
I've only ever tested on 1.5.
[Android Head-Units] wisdomcm6:
Has any one did this root method on the new dnn991hd? Does it used the same software as the dnn990hd? I was thinking of purchasing the dnn991hd and root it if its possible.
[Android Head-Units] mike2246:
so I did the 1.5 update and now it gets to the Initial Setup page and reboots in about 10-15sec. any ideas?
[Android Head-Units] oxman504:
I'd think that if you flashed a factory update over a rooted device that you would lose root.
[Android Head-Units] mike2246:
I took it to a repair center will update when I get it back, guess everyone knows now if your root don't update.
[Android Head-Units] oxman504:
That's root 101.
[Android Head-Units] belkre:
So slight metaexploit problem I am having I get a session number and when I "sessions -i 1" it just responds starting interaction with 1 then stalls there. I assume I am doing something wrong any ideas.
[Android Head-Units] Dudaaltieri:
Helo!

Just Donate something, next month I´ll do more, ehehhehehhe I´m going to try to root it now, nerve use metasploit but have a good android experience since Galaxy SI, now I have S4 and did all the wrong stuff to learn something

I wish I could help more beyond money but that is not my area but thanks for the job!!

Hope everything works for me !
[Android Head-Units] chris.davis925:
Just follow the steps.

---------- Post added at 07:14 PM ---------- Previous post was at 07:13 PM ----------

Has anyone been able to make any progress with CWM recovery images or /system mount lock?

---------- Post added at 07:15 PM ---------- Previous post was at 07:14 PM ----------

Has anyone been able to make any progress with CWM recovery images or /system mount lock?
[Android Head-Units] belkre:
root success on dnn-770hd with version 1.5 thanks chris.davis925 your my hero.
[Android Head-Units] pdanders11:
Are you running metasploit of the kali distribution or did you install on another distribution like Ubuntu. Sounds like some of the weird things I saw on a Ubuntu install. I've been to busy to see if kali solves my issues.
[Android Head-Units] belkre:
it was an issue with the console I used the web interface and all worked out.
[Android Head-Units] aplusmiami:
I was able to successfully do 3 radios - 2 in Linux Ubuntu latest build and 1 in windows 7. Thanks for your work Chris!

I have loaded successfully:

Astro File Explorer

Spotify

Pandora

Android Screen Rotation (http://xdaforums.com/showthread.php?t=2331514)

All through direct link downloads from the browser.

Just some notes:

In order to hear audio in Spotify I switched the deck to USB device with nothing connected.
[Android Head-Units] radux.m.dan:
3G Modem

Hello all!

Now that we got a nice root it was time to add a 3G modem so I can use spotify while driving around town :)

I'm using a USB stick from Tchibo, which in fact is Huawei E173 and I unlocked it from the network to be able to use it in Romania.

I dowloaded the kernel (3.0.8) source from telechips website and started to compile the drivers I needed. I also installed a widget

PPP Widget to be able to control the connection, but only works with a different launcher (I use nova).

I attach you the kernel objects just in case someone would like to use them.

Enjoy!
[Android Head-Units] chris.davis925:
Where you able to successfully drop these into /system partition?
[Android Head-Units] radux.m.dan:
I used insmod to test the modules first. Then dmesg to check if everything is fine.

The PPP Widget has a folder lib so I put these kernel objects there and it will load them when needed, ex connecting the 3G stick on USB.

I haven't tried to add the .ko files in /system/lib/modules.. but I think it should be possible.

Cheers!
[Android Head-Units] funkytrone:
New Apps

I want to get started creating some new apps for the DNN990 now that we can install apps. Mainly, I want create a custom app for siriusxm. My background is electrical engineering and not xml or java programming. 6 or 7 years ago I took an entry level java course and a course on micro controllers. I believe I've had enough exposure to those languages and android programming tutorials to ultimately create something useful. However, I'm sure where to begin to figure out to communicate with the siriusxm tuner.

From this forum someone posted that the radio uses a TCC8801 processor. There a number of different ports that this processor has. I'm not too sure which one is the most likely one for communicating with the tuner. I assume it must serial communication and perhaps the i2c protocol?? My current understanding only gets me to this point. Any input and direction would be appreciated.
[Android Head-Units] aplusmiami:
I do not have a programming background.. I think Chris is right a custom recovery needs top come first.
[Android Head-Units] kizilcali81:
I tried the metasploit method on newest dnn9250dab (european version of dnn991hd i think but not sure) and it worked just fine. Thank you
[Android Head-Units] chris.davis925:
Is anyone making any progress on the recovery?
[Android Head-Units] jbeavis19:
Does anyone have the command to make the system rw again after it locks with Chris's root applied.
[Android Head-Units] radux.m.dan:
logs

Hi!

Can you take a log so maybe we can get an idea of is happening.

Use adb connect your_ip and after you are connected use adb logcat > log.txt

Attach the log file here please.

Regards!