[Android Auto General] mikereidis:
:)

This is the version request packet:

and yes it is unencrypted.

The next step is supposed to be the SSL hand-shake, initiated by the HU after it gets it's version response.

I can send some other packets, like ping, with no encryption. But AA refuses to respond without an SSL context.

I'm not aware of exactly how the handshake is done. Some experimenting with the ssl wrapper library might be in order. And I thought I saw some debug settings that might disable authentication.

Why would the HU authenticate AA ? I'm thinking that this would prevent other mobile OS's from working with AA cars and HUs. One might be able to use extracted private keys, but that becomes a DMCA DRM circumvention with all it's legal problems. I'm guessing DMCA trumps interoperability defences. But then there is anti-trust and all the legal trouble Google is having in Europe lately...

Should take a look to see if Pioneer is using any GPL code in a way that compels source code release. They've been forced to comply before. But then much of it is Google's code ?

So instead of the SSL handshake I just sent an unsolicited and unencrypted service discovery response. It made lots of stuff happen, but then popped up a dialog saying the car must be stopped/not moving in order to setup. Maybe because authentication was bypassed. But maybe I can manually set the setup setttings first...

Here's the log. I note there are country (regulatory issues) and phone white/blacklists too.

Having to replug or power restart the USB ports is a major pain so far too. And even WiFi ADB+logcat resets when USB resets too. Having a real HU for USB sniffing would likely be useful.

04-04 03:31:37.356 D/CAR.GAL (12991): Car requests protocol version 1.1
04-04 03:31:37.357 D/CAR.GAL (12991): Waiting for authentication...
04-04 03:31:37.363 E/UsbDeviceManagerJNI( 744): could not open /dev/usb_accessory
04-04 03:31:37.363 E/UsbDeviceManagerJNI( 744): could not open /dev/usb_accessory
04-04 03:31:38.355 D/CAR.SERVICE(12991): onCarInfo com.google.android.gms.car.CarInfoInternal[dbId=0,manufacturer=,model=,headUnitProtocolVersion=1.1,modelYear=,vehicleId=null,bluetoothAllowed=false,hideProjectedClock=false]
04-04 03:31:38.369 D/CAR.SERVICE(12991): Connection count = 19
04-04 03:31:38.369 W/CAR.SERVICE(12991): car not supporting sensor
04-04 03:31:38.372 I/Timeline(12991): Timeline: Activity_launch_request id:com.google.android.gms time:7192580
04-04 03:31:38.372 I/ActivityManager( 744): START u0 {flg=0x10010000 cmp=com.google.android.gms/.car.SetupActivity} from uid 10069 on display 0

04-04 03:31:38.431 D/FsmController(12991): State stack (size=1)
04-04 03:31:38.431 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$WaitingForCarConnectionState
04-04 03:31:38.431 D/CAR.CLIENT(12991): connect
04-04 03:31:38.447 D/CAR.CLIENT(12991): Skip meta-data checks; first-party skip list [com.google.android.gms]
04-04 03:31:38.452 D/CAR.SERVICE(12991): Package in whitelist; name: com.google.android.gms
04-04 03:31:38.470 D/CAR.SETUP(12991): Connected to CarService

04-04 03:31:38.470 I/FsmController(12991): fireEvent(EVENT_CONNECTED_TO_CAR)
04-04 03:31:38.471 D/FsmController(12991): State stack (size=1)
04-04 03:31:38.471 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$CheckCountryWhitelistState
04-04 03:31:38.473 D/CAR.SETUP.SetupFsm(12991): Country is not whitelisted: ca but gearhead.apk is installed, so we continue

04-04 03:31:38.473 I/FsmController(12991): fireEvent(EVENT_GEARHEAD_APK_INSTALLED)
04-04 03:31:38.474 D/FsmController(12991): State stack (size=1)
04-04 03:31:38.474 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$CheckPhonesBlacklistState
04-04 03:31:38.474 D/CAR.SETUP.SetupFsm(12991): Phone is not blacklisted: cm_m8

04-04 03:31:38.474 I/FsmController(12991): fireEvent(EVENT_PHONE_NOT_IN_BLACKLIST)
04-04 03:31:38.475 D/FsmController(12991): State stack (size=1)
04-04 03:31:38.475 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$AuthorizingCarConnectionState
04-04 03:31:38.475 D/CAR.SETUP.SetupFsm(12991): Start 30s dimissal timer

04-04 03:31:38.475 I/FsmController(12991): fireEvent(EVENT_CAR_STARTED_MOVING)
04-04 03:31:38.476 D/FsmController(12991): State stack (size=2)
04-04 03:31:38.476 D/FsmController(12991): 1: com.google.android.gms.car.SetupFsm$CarMovingState
04-04 03:31:38.476 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$AuthorizingCarConnectionState

04-04 03:31:38.476 D/CAR.CLIENT(12991): DefaultConnectionCallbacks#onConnected
04-04 03:31:38.476 D/CAR.SERVICE(12991): Registering carconnectionlistener com.google.android.gms.car.dx@1f95d4b1 clients:2
04-04 03:31:38.481 D/i (12991): Started with mStateId=4 mState=com.google.android.gms.car.SetupFsm$CarMovingState@b7fad96
04-04 03:31:38.497 D/i (12991): Started with mStateId=5 mState=com.google.android.gms.car.SetupFsm$CarMovingState@b7fad96
04-04 03:31:38.513 I/ActivityManager( 744): Displayed com.google.android.gms/.car.SetupActivity: +126ms (total +2s359ms)

04-04 03:31:52.502 D/CAR.SETUP.SetupFsm(12991): Dismissing FRX because of 30s timer
04-04 03:31:52.502 I/FsmController(12991): fireEvent(EVENT_CAR_DISCONNECTED)

04-04 03:32:08.483 D/CAR.SETUP.SetupFsm(12991): Dismissing FRX because of 30s timer
04-04 03:32:08.483 I/FsmController(12991): fireEvent(EVENT_CAR_DISCONNECTED)
04-04 03:32:08.486 D/FsmController(12991): State stack (size=2)
04-04 03:32:08.487 D/FsmController(12991): 1: com.google.android.gms.car.SetupFsm$SetupFailedState
04-04 03:32:08.487 D/FsmController(12991): 0: com.google.android.gms.car.SetupFsm$AuthorizingCarConnectionState
04-04 03:32:08.487 D/CAR.SERVICE(12991): onSetupFailure
04-04 03:32:08.487 D/CAR.GAL (12991): send ByeByeRequest
04-04 03:32:08.494 W/System.err(12991): java.lang.IllegalStateException: Cannot send an encrypted frame with no ssl context.
04-04 03:32:08.495 W/System.err(12991): at com.google.android.gms.car.senderprotocol.ad.a(SourceFile:578)
04-04 03:32:08.495 W/System.err(12991): at com.google.android.gms.car.senderprotocol.ag.run(SourceFile:343)
04-04 03:32:08.496 E/CAR.GAL (12991): WriterThread: exiting due to IO error
04-04 03:32:08.535 W/CAR.SERVICE(12991): Critical error 3 msg: IO error
04-04 03:32:08.538 I/ActivityManager( 744): START u0 {act=android.intent.action.MAIN cat=[android.intent.category.HOME] flg=0x10200000 cmp=com.google.android.googlequicksearchbox/com.google.android.launcher.GEL} from uid 1000 on display 0
04-04 03:32:08.542 D/CAR.SERVICE(12991): notifying car connection listeners of disconnection, clients:2
04-04 03:32:08.545 D/CAR.POWER(12991): stopping power management
04-04 03:32:08.546 D/CAR.POWER(12991): battery not monitored
04-04 03:32:08.546 D/CAR.TEL.CarCallService(12991): onDisconnected
04-04 03:32:08.546 D/CAR.TEL.PhoneAdapter(12991): Returning an existing PhoneAdapter instance.
04-04 03:32:08.546 D/CAR.TEL.PhoneAdapter(12991): removeListener: com.google.android.gms.car.dk@3053bee6
04-04 03:32:08.947 W/CAR.GAL (12991): reader thread stuck? Trying SIGQUIT.
04-04 03:32:08.947 I/Process (12991): Sending signal. PID: 12991 SIG: 3
04-04 03:32:08.948 I/Process (12991): Sending signal. PID: 12991 SIG: 3
04-04 03:32:08.951 I/art (12991): Thread[5,tid=13000,WaitingInMainSignalCatcherLoop,Thread*=0xaf60e400,peer=0x32c07080,"Signal Catcher"]: reacting to signal 3
04-04 03:32:09.034 W/ActivityManager( 744): Activity pause timeout for ActivityRecord{5a2b02e u0 com.google.android.gms/.car.SetupActivity t564 f}

04-04 03:32:09.238 I/CAR.GAL (12991): IO exception: java.io.IOException: read failed: ENODEV (No such device)
04-04 03:32:09.238 I/art (12991): Wrote stack traces to '/data/anr/traces.txt'
04-04 03:32:09.285 I/HotwordWorker( 2141): onReady
04-04 03:32:09.349 D/CAR.SERVICE(12991): reader thread stuck after cable removal. will kill process.
04-04 03:32:09.349 I/Process (12991): Sending signal. PID: 12991 SIG: 9
04-04 03:32:09.365 E/CAR.CLIENT( 5698): ICar died!
04-04 03:32:09.367 I/WindowState( 744): WIN DEATH: Window{18c41b48 u0 com.google.android.gms/com.google.android.gms.car.SetupActivity}