[Windows Mobile Development and Hacking General] kthejoker20:
Ok Devs-

(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).

I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.

I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.

I was able to tigger the install event with those files.

And I believe this is our key to Jailbreak the system.

The best part is that you can run stacked commands on those install scripts:p. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs

I have been struggling to get it it to execute, presumably, I don't know anything about win CE.

I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.:D

This is what my path is listed on my autoinstall.1st file -

Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe

the cab is required as it is signed by microsoft and bypasses the lock to load additional code.

Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.

Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.

SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?

If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.

Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.

I have also attached the sync app developer guide link. With programming commands for apps.

https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf

Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.

http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf

UPDATE: 04/19/2015 -

While it is not a software hack, IT IS possible to unlock the navigation only portion of the MFT 8", if you have it without nav.

IF YOU DO THIS, YOUR CAR WARRANTY IS VOID. You've been warned.

It will cost a little money, but not set you back $1000 like nav tv and lockpick are charging. Maybe $100 or so.

Here is what you need to do, if you can't wait for us to unlock the bootloader.....

1 - Get a used APIM only part with the numbers DS7T in it. (aluminum only part with the fins, you DO NOT need the screen)

2 - Get the VIN# of the car it came out of and check the VIN to see if it was enabled with factory NAV. There are internet sites that will check the VIN for you. Must be a unit with NAV enabled.

http://researchmaniacs.com/VIN-Number-Lookup/WindowSticker/Ford.html

3. Install the APIM only to the back of your LCD.

4. The system will reboot and reset.

5. The system will them ask you to insert the NAV sd card, do that. (obviously, you have to buy a nav card from ebay as well, but those are $10)

6. Enjoy factory NAV for about $100

This is the only workaround for now. THE APIM is separate from the sync system and only interfaces with it. So, you will retain all your OEM VIN# locked stuff and it will survive reboots and updates. The nac actually just unlocks on that APIM portion, believe it or not. This method doesn't tie into the file system software, it merely accesses it.

Now.... if someone would be so kind as to just rip the NAND chip from one of those units and post it, so that we can just flash over our existing equipment, we can do this for FREE!!!!!!

Still working on the video bypass.... It would be nice if our Russian friends can start chiming in for that one please.....

DON"T FALL FOR THE EBAY GUY CHARGING $600 to $700 for this. Let's put him out of business.... Your help is needed.

PROPS TO rahrena8690 for the find.

WORKING FILE LINKS - FOR DEVELOPERS ONLY

Delayed Reboot project

https://mega.co.nz/#!m0BEWSrA!qrdgIRYTvccH52794ktdpRfrulI_pSdY3g-iiCyhaFs