yashsingh1/xdaforums huggingface dataset:
[Connected Car] incogn1to:
I've added support for audio sources. Now if you click ok you should see available audio sources.

If you select one - playback should start.

Investigating option of adding proper playlist.
[Connected Car] konradmik:
Guys, how to force SCT to shut down after the ignition is off? Now I'm pretty sure it doesn't turn off and drains my battery.
[Connected Car] kristenstewart:
great job (y)
[Connected Car] flash2k6:
Does anyone have the latest SCT firmware they can PM me? Thanks much!
[Connected Car] Leetxjd:
In looking at the pics on the first post, there are elements to is that look very raspberry pi or SBC. Is there a way to use the wiring for the SCT and some sort of refit?
[Connected Car] incogn1to:
Have somebody managed to gain access over audio service playlist?

I'm still struggling with this part.

I've tried to dissasemble com.parrot.medialist, unfortunatelly some classes can't be rebuilt. Do somebody have information on HSTI interface?

BTW latest BCU version is availible here:

https://bitbucket.org/incogn1to/bcu/src
[Connected Car] incogn1to:
Leetxjd

Latest firmware:

ACU_VOLVO_EU_update.plf

drive.google.com
[Connected Car] incogn1to:
Is it possible to recover from this state? I tried to put ACU_VOLVO_EU_update.plf on usb stick or sd card, but unit is unable to see it.
[Connected Car] rwientjens:
Yesterday I removed the SCT out of my 2013 V60 D6. And I installed a 3rd party android auto box.

Still SCT is in the menu and I have no sound, also not from the original FM radio.

And the control buttons on the waterfall do not respond.

Does the car need a 'firmware downgrade' or so to tell it SCT is gone?
[Connected Car] incogn1to:
Interesting. I've removed mine. Everything works fine. Will probably replace SCT with something else.

XC60 2013
[Connected Car] AndreaBosi:
Hi to everyone, i've got a question.. is it possible to have apple CarPlay in this android parrot sensus connect touch system?

Thank u so much!

Andrea
[Connected Car] MrT R:
Good day, i have Volvo S60 2012 with sensus connected touch that i have rooted it following the forum here. but as we all know that everything is too old and many things are not supported anymore from google. Is there any device that can replace this parrot system in the glovebox ? there are many chinese boxes that can be installed by taking the whole front console out and i do not want to do that? any ideas?
[Connected Car] fkruis:
Thar configuration part of the car needs to be removed.
[Connected Car] MrT R:
can you please share the 3rd party android auto/Carplay box that you installed and from where you got it, thanks
[Connected Car] fkruis:
That was not me
[Connected Car] Targan:
is the link dead ?
[Connected Car] spi123312142:
Would this or something similar work also on the new sensus >2015-2020 XC90
[Connected Car] incogn1to:
Maybe somebody have a spare SCT module that is still alive? I killed mine during some experiments.
[Connected Car] marky12323:
Ayone has got the dumps of Sensus Connected unit? Or the firmware files for update it?

I can help to unlock the unit
[Connected Car] incogn1to:
Are you talking about PLF update file? Here is the 1.49.34 EU file.

ACU_VOLVO_EU_update.plf

drive.google.com
[Connected Car] marky12323:
Hi, thanks for reply.

I need the firmware files for Volvo Sensus iam 2.1 level
[Connected Car] incogn1to:
Then you are probably in wrong topic.
[Connected Car] marky12323:
The problem is that I can't find the right topic for it and I thought it might fit :)
[Connected Car] johnnie_w:
Jep, tried them all. Is the segmentation fault normal?
[Connected Car] gekkekoe123:
No its not. Do you also have logcat of 1 error?

I might nog have implenented all the JNIEnv callbacks.
[Connected Car] gekkekoe123:
Thanks.

As last test, you could also try to install the apk wikango with framaroot in it. the one that only installs classes.dex

The so might need some stuff from it.

I will hava a look and see if I didn't miss anything. I can also try to run the Check() method before exploit.

bummer that it didn't worked right away
[Connected Car] johnnie_w:
OK, I will leave my car then, getting cold here :)
[Connected Car] gekkekoe123:
Ok I managed to interface with dalvik vm and created an JNIEnv. I'm not faking an jnienv now. So we should get further.

Try this one and let me know how this works out.

Also try to install the frama classes.dex , using the wikango apk. The frama lib might load stuff when using the adb activity.

Usage:

adb push libframalib.so /data/local/.
adb push sploit /data/local
adb shell chmod 755 /data/local/sploit

Now try each of the following and check for root after each try:

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 0 Gimli 0

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 1 Gimli 0

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 0 Gimli 1

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 1 Gimli 1

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 0 Gimli 2

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 1 Gimli 2

Interpretation of the commands:

# use normal activity with Gimli exploit and selected idx 0 from root menu

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 1 Gimli 0

# use ADB activity with Gimli exploit and selected idx 0 from root menu

adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 0 Gimli 0

Please post output and adb logcat in case of problems.
[Connected Car] getiem:
Thanks, will try in a minute

From interpretation, I get you mean the apk from this post?

http://xdaforums.com/showthread.php?p=46955258#post46955258
[Connected Car] gekkekoe123:
The one that halfly installs framaroot. That john used. I'm not certain if it's needed but can't hurt to try.

If all of this doesn't work, I'll try to instantiate the classes myself from the tool.
[Connected Car] getiem:
Everything does not work. Tried every command, but got this:

D:\Program Files\adt-bundle-windows-x86_64-20130219\adt-bundle-windows-x86_64-20130219\sdk\platform-tools>adb shell LD_LIBRARY_PATH=/data/local /data/local/sploit 0 Gimli 0
Command line Frama root by Gekkekoe, (credits alephzain for framalib)
Creating VM
JNIEnv: 0xd550
created jstring 0x40020810
Using adb activity
[1] Segmentation fault LD_LIBRARY_PATH=...

Will post the complete commandlog and the logcat at around 12 o-clock (within 3 hours)

Tried first without installing the incomplete frama

Then second try all commands after installing that eviltemp.
[Connected Car] gekkekoe123:
Ok, I'll await the logcat.
[Connected Car] gekkekoe123:
Ok, This does give a hint. let me see what I can pull.
[Connected Car] getiem:
To be complete, here are my logs.

First push your files

pushsploitlog.txt

then execute your sploit

sploit_execute.log.txt

then install the unfinished frama apk

installevilapk.log.txt

then second try execute

second_try_spoitexecute.log.txt
[Connected Car] getiem:
On the site of parrot there is a new PLF update for north america, with version numer 1.47.96

Now downloading, not to install, but to see if we can find some differences (ADB script for example).

http://www.parrot.com/uk/support/sensus-connected-touch
[Connected Car] getiem:
In the USA update 1.47.96, this line is still there, so ADB should work. File init.parrot.fc6100.sh matches completely with previous version.
[Connected Car] gekkekoe123:
Ok, It was hard using C to invoke jvm directly. I figured out that we can nativly invoke dalvik through java.

Attached is an cmd line java version of the tool.

[Edit]

I think this is getting good. I get result code 6 from the frama lib in the emulator instead of segfaults.

So please test it!!! My emulator is not vulnerable

Usage:

adb push libframalib.so /data/local/.
adb push sploit.jar /data/local/.
adb shell mkdir /data/local/tmp/dalvik-cache

Actually the tool will print wich exploits will probably work on your device ;)

Now try each of the following and check for root after each try:

Option 0 installs superSu, so check for that apk to see if the exploit worked. See frama root for the rest of the options

adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 1
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 2
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaActivity Gimli 0
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaActivity Gimli 1
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaActivity Gimli 2

Please post output and adb logcat in case of problems. If it works buy me a beer ;)
[Connected Car] donaldta:
Actually, I don't expect Parrot to get rid of ADB access. After all, it is helpful for the Volvo technicians to do analysis. However, what we're most concerned about in the future updates, is them patching out the security holes which could be used to gain access to root. There are a lot of devices in the Android market space which could only be rooted during the early implementation, but cannot be rooted if updated beyond a particular firmware update, like in the Chromecast or Google TV boxes.
[Connected Car] gekkekoe123:
Looks like typos. let me double check

Did you download the correct version ?!

this my output:

$ adb push libframalib.so /data/local/.
2674 KB/s (2013928 bytes in 0.735s)
$ adb push sploit.jar /data/local/.
210 KB/s (1632 bytes in 0.007s)
$ adb shell LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0
cmd line frama root by Gekkekkoe
Credits to alephzain for Framalib
using Exploit: Gimli choice: 0
Executing Check
Executing Check Completed
Result: 6

Aha from your log:

11-05 19:17:36.080: D/dalvikvm(3216): creating instr width table
11-05 19:17:36.120: E/dalvikvm(3216): Can't open dex cache '/data/dalvik-cache/data@local@sploit.jar@classes.dex': No such file or directory
11-05 19:17:36.120: I/dalvikvm(3216): Unable to open or create cache for /data/local/sploit.jar (/data/dalvik-cache/data@local@sploit.jar@classes.dex)
11-05 19:17:36.120: W/dalvikvm(3216): threadid=1: thread exiting with uncaught exception (group=0x40015560)

Seems like it does not load my classes.dex in the correct location on the car. Let me see how I can redirect that.

Could you verify that /data/dalvik-cache/data@local@sploit.jar@classes.dex does indeed not exists on you unit?

OK found the solution

adb shell mkdir /data/local/tmp/dalvik-cache
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0

Dalvikvm writes in /data/dalvik-cache folder. It needs root for that. But we can create a tmp folder and regenerate the odex files ;)

ok beer time :P
[Connected Car] donaldta:
I have a script that I used to check the changes with the last SCT updates. Figured that I could go ahead and modify it for the SCT.

knoppix@Microknoppix:~/Downloads$ ls -ld SCT/*/FileSystem/system/
drwxr-xr-x 15 root root 416 Nov 5 14:25 SCT/v1.47.88/FileSystem/system/
drwxr-xr-x 15 root root 416 Nov 5 14:32 SCT/v1.47.96/FileSystem/system/
knoppix@Microknoppix:~/Downloads$ cat check_vers
date > output_checkvers.txt
for i in `find SCT/v1.47.96 -type f`
do j=`basename ${i}`
k=`echo ${i} | sed 's/v1.47.96/v1.47.88/'`
echo ---${j}--- >>output_checkvers.txt
diff -q ${i} ${k} >>output_checkvers.txt 2>&1
done
knoppix@Microknoppix:~/Downloads$ ./check_vers
knoppix@Microknoppix:~/Downloads$ grep differ output_checkvers.txt | wc -l
173
knoppix@Microknoppix:~/Downloads$ grep such output_checkvers.txt | wc -l
83
knoppix@Microknoppix:~/Downloads$

Basically, I have both versions of the plf uncompressed into their own directory. The script creates or refreshes the output file with the date and time as the header then finds all the path to every file in each subdirectory. For each iteration it adds a separator in the form of dashes that wrap around the filename and then checks the difference between the new and old files. If there is a difference or no file exist then it is noted and appended to the output file, otherwise it continues to parse through the list of files.

In the last two lines of the shell, I check the output file for patterns that match the words, "differ" and "such" then count each line. This tells me that there are 173 files that are different and 83 new files added to the update which didn't exist in the previous version. Here is an excerpt of the file it creates.

---rb0pt2pt-BR22pt-BR_ta.pil---
diff: SCT/v1.47.88/FileSystem/system/CKSOFT_RO/SOPRANO/pt-BR/TTS/SVOX/rb0pt2pt-BR22pt-BR_ta.pil: No such file or directory
---config.xml---
Files SCT/v1.47.96/FileSystem/system/CKSOFT_RO/SOPRANO/config.xml and SCT/v1.47.88/FileSystem/system/CKSOFT_RO/SOPRANO/config.xml differ
---Tango.xml---
---softat_settings.ini---
Files SCT/v1.47.96/FileSystem/system/CKSOFT_RO/softat_settings.ini and SCT/v1.47.88/FileSystem/system/CKSOFT_RO/softat_settings.ini differ
---volume_ramp_ALARM.txt---
---volume_ramp_MUSIC_OUT.txt---
---CKSOFT_restore.sh---

The above tells us that Tango.xml, volume_ramp_ALARM.txt and volume_ramp_MUSIC_OUT.txt are the same between version. Where as the file, rb0pt2pt-BR22pt-BR_ta.pil, only exists in the new version and config.xml & softat_settings.ini are different between the two versions.

I'll attach the output of the script in case any one is curious to see the rest of it.
[Connected Car] johnnie_w:
AND WE HAVE A WINNER!

$ mkdir /data/local/tmp/dalvik-cache
$ ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0

cmd line frama root by Gekkekkoe
Credits to alephzain for Framalib
using Exploit: Gimli choice: 0
Executing Check
idx: 0 value: Gimli
idx: 1 value: Aragorn
Executing Check Completed
No such user 'root:root'
No such user 'root:root'
Result: 0
$
$ su
# id
uid=0(root) gid=0(root)
#

You are awesome! Now let's see what's possible!
[Connected Car] gekkekoe123:
oh yeah oh yeah :D

We can follow the parrot thread. Should work the same now.

Damn now I need to find funds to buy me a unit.
[Connected Car] johnnie_w:
OK, good news! We have Flitsmeister running! Finally a capable system that we can tweak! AWESOME!
[Connected Car] gekkekoe123:
Euh you have basically full control over the unit now.

- You can now allow install from unknow sources.

- you can install google playstore... and Get TOMTOM on it :)

- See the parrot thread, once you have root

I cleaned up the code. Attached is the working version.

I will make a version that autodetects and exploits. But thats for the coming days :)

Usage:

adb push libframalib.so /data/local/.
adb push sploit.jar /data/local/.
adb shell mkdir /data/local/tmp/dalvik-cache
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0
[or]
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaActivity Gimli 0
[Connected Car] johnnie_w:
Install from unknown sources is on by default. So the way to install APK's is:

adb push app.apk /data/local
adb shell
$ su
# mount -o remount,rw ubi0:system /system
# cp /data/local/app.apk /system/app
# chmod 666 /system/app/app.apk
# reboot

This should get your app installed. After the first reboot the SuperUser APK will get installed, so you might have to press yes when running the su command.
[Connected Car] gekkekoe123:
YEAH we can remount /system for rw now ;) and push apks directly on it.

adb shell su root -c 'mount -o remount,rw /system'
adb push <yourapk> /system/.
adb shell reboot

But get google playstore on it.

There's also a whitelist.xml where you can enable apps during drive. dont forget to add apps that you want to be able to run during driving. Tomtom is already in there :)
[Connected Car] johnnie_w:
Indeed, I missed that step and added it :) Maybe Get!em can update his topicstart. I will spend more time Thursday evening with the device. Some screenshots attached as evidence :)
[Connected Car] johnnie_w:
This wont work... This will:

adb shell su root -c 'mount -o remount,rw ubi0:system /system'
adb push <yourapk> /system/app/ && chmod 666 /system/app/<yourapk>
adb shell reboot
[Connected Car] gekkekoe123:
ok, the command I posted normally works for phones, but this parrot thing might be slightly different.

either way, system is open now :laugh:
[Connected Car] donaldta:
Congratulations, gekkekoe!

Are you sure that you don't have to change the following section from the "/system/build.prop" file from false to true?

That will probably allow you to use "adb install <package.name.apk>"

#TODO Set to false for prod
#Package install limitations. Set to false to allow only the install of verified packages
ro.parrot.install.allow-all=false

In any case, to help you out with the market here the two files necessary. You won't need AccountAndSyncSettings since that's already included with the SCT.
[Connected Car] donaldta:
Actually, you were missing the app directory. The "push /system" only puts at the root of system where is should be "/system/app/" which is common on all android devices for the apps that come with the firmware. ;)
[Connected Car] misteriks:
Thx

A BIG Thanks for all the effort you guys have put in this! I really appreciate this.

I will get my volvo in 2 days so the rootjust in time.
[Connected Car] xadax:
Thanks all for getting this done!

:good: :p :cyclops: ;) :D :cowboy: :o :angel: :) :victory: :silly: :laugh: :mad: :highfive: :cool:

Volvo was asking for this, they have put this badly crippled unit on the market (I don't think it was Parrots' idea to close it up like that).

Now it is time to make some serious use of the SCT.

Time for some great apps, add a Bluetooth dongle for keyboard/tracker and get live OBD-2 data on screen, dash-cam...

And much much more...
[Connected Car] stavas:
Wooohoooo!

Thanks for all the awesome work, everyone!

I'm getting my V60 in a few weeks, can't wait trying this out.

I probably will get the updated version, since it will be delivered after W46. Maybe I should ask them not to update to the latest version?
[Connected Car] bluesbroeder:
Thanks for all the effort and for getting this done!!:laugh::good:

This is really awesome.

I'am not really a dummy, but can someone make a short explanantion how we can install other app's on the SCT.

The lot of files and testings are confuse me a littel bit, I would really appreciate it.

Thanks a lot!
[Connected Car] gekkekoe123:
Root your SCT using the instructions here:

http://xdaforums.com/showpost.php?p=47158577&postcount=244

then:

download the 2 apks from http://xdaforums.com/showpost.php?p=47161524&postcount=250

afterwards install the apks.

adb shell su root -c 'mount -o remount,rw ubi0:system /system'
adb push GoogleServicesFramework-2.2.1.apk /system/app/ && chmod 666 /system/app/GoogleServicesFramework-2.2.1.apk
adb push Market-3.3.11.apk /system/app/ && chmod 666 /system/app/Market-3.3.11.apk
adb shell reboot

After boot you should have google play store and should be able to install everything.

These step are only required if the market doens't work properly.

If you still can't install from the market double check the contents of

'/system/build.prop'

adb shell cat /system/build.prop

#TODO Set to false for prod #Package install limitations. Set to false to allow only the install of verified packages
ro.parrot.install.allow-all=false

set property to true

adb pull /system/build.prop

edit content and set to true. Content of the file should look like this

#TODO Set to false for prod #Package install limitations. Set to false to allow only the install of verified packages
ro.parrot.install.allow-all=true

replace build.prop with proper one.

adb shell su root -c 'mount -o remount,rw ubi0:system /system'
adb push build.prop /system/build.prop

disclaimer: I have not tested it on an actual unit, but these step should do it
[Connected Car] Zakraket:
Great work! :highfive::highfive::highfive::highfive::highfive:

me 2 :)

Would love to get Google-nav going on the SCT (and of course every other great app)

edit: hey, CrazyCow :) that's fast. Thanks, I will try this out as soon as possible

edit2: hmm...I have no clue what to do. A bit too technical for me, I'm a Androidnoob
[Connected Car] johnnie_w:
This morning I drove to work with Flitsmeister running in the background. It worked perfectly! I had to add "nl.flitsmeister" to the whitelist.xml, otherwise it wouldn't run during driving. I don't have much time this week, so I will probably spent time friday or saturday again. But it feels good to be in control again :)
[Connected Car] Tankiej:
Awesome work guys! Would love to have Flitsmeister and some other apps on SCT! But since I'm queit the beginner in rooting (did manage to root my phone, with some help), I have no idea how to get started with it. Even with gekkekoe123's post..
[Connected Car] getiem:
Great work. Much thanks to Donaldta and Gekkekoe!

I put up some changes into the Opening Post. If anyone has time to find some errors or some info to add to it, send me a PM with the information (in the right format, so I can copy paste it into the OP)
[Connected Car] stavas:
Could we also add to the OP which versionsnummer that are supported? There is supposed to be an update to SCT W46, but I still don't know the version number of it.
[Connected Car] getiem:
I have not read the complete Parrot threads, but does it make sense to fill a *.*.* reference in this whitelist, so all apps will be allowed?
[Connected Car] getiem:
Will do tomorrow ;)
[Connected Car] twcoolen:
GREAT WORK TO ALL!!! :good:

Question, since I am quite a noob when it comes to ADB

adb push libframalib.so /data/local/.
adb push sploit.jar /data/local/.
adb shell mkdir /data/local/tmp/dalvik-cache
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaAdbActivity Gimli 0
[or]
adb shell ANDROID_DATA=/data/local/tmp LD_LIBRARY_PATH=/data/local dalvikvm -cp /data/local/sploit.jar com.alephzain.framaroot.FramaActivity Gimli 0

Should I specify the path name on my laptop of both the .so and .jar file in the script above? Or is putting both files in the same directory as adb sufficient?
[Connected Car] gekkekoe123:
same folder is ok, but putting adb in path is better.

@DonalD:

that might be a good idea. But does Craze support scripting or something for us to put it in there instead of building an app.

btw: I'm seeing a lot of ppl from that other forum here LOL
[Connected Car] donaldta:
Either way is fine it just needs to know which while and where it is located. If it is in the same directory then obviously you don't need the paths. The adb command is a self-contained command, so if your .so and .jar files are in a different directory then you can use "open command window here" right-click option and specify the path to adb instead.
[Connected Car] getiem:
"Open command window here" is available in windows explorer when you hold the shift-button during right-mouse-button.

If paths contain spaces, set quotes around your path;

example:

adb push "c:\example path to frama\examplefilename.so" /data/local

Developer of craze is also on XDA:

http://xdaforums.com/showthread.php?t=2260828

Direct link to the Play Store: https://play.google.com/store/apps/details?id=evo.dev.craze

You mean Volvo owners :)

To all: keep the thread clean as possible, try to read all posts before asking :)

(I know, have to do it myself too :) )