yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] nanddroid:
Unit non navi EU see inside

Hi all

Thanks for the job on this forum

I open a non navi EU unit

I take some pictures from all component and share http :// we.tl/ 0dyZMu3eqa

You have inside the unit a hidden usb see pictures 20160328_100803+809+828+113743

So i connect to my computer pictures 162249+162328, i can see folder

Alarms

Android

DCIM

Download

Movies

Music

Notifications

Pictures

Podcast

Ringtones

Try to connect with adb 1.4.3 but say no device found ?

Hope this can help

PS : I can have a EU unit with nav to do the same job

regards

nice day

Frederic
[Android Q&A, Help & Troubleshooting] uid6011:
Maybe you can look at the Navi version of the unit also the same way?

When you install the navi version update on the non navi unit then the Garmin works but it looks like the image files are on the unit and are not on the update. IF there would be a navi file folder it would be maybe possible to upgrade no navi units to the original garmin navi.
[Android Q&A, Help & Troubleshooting] nanddroid:
hi

in debug mode ask me a driver for USB\VID_0955&PID_7100&REV_0232&MI_01 for MY15ADA

i use win 7 32

ADB don't find any devices

from a folder .com.xxapppxxx.app is it possible to create an apk ?

regards

fred
[Android Q&A, Help & Troubleshooting] nanddroid:
Hello

of course i will do it !

do you think we can simply copy the .com.garmin from navi to other ?
[Android Q&A, Help & Troubleshooting] nanddroid:
last news

install usb driver Tegra

now have usb adb connection

next week i do the same with nav
[Android Q&A, Help & Troubleshooting] nanddroid:
hi

Need some help to root the device

try two solutions see attachments

but no luck

any idea ?

thanks
[Android Q&A, Help & Troubleshooting] kondormit:
Great progress. Did you done all this using secret usb port?
[Android Q&A, Help & Troubleshooting] nanddroid:
hi

Not really secret but hidden

Yes i have done all by this usb port, i prefer cable than wifi

to resume

those radio are paired to the ecm (of the car) and the VIN number of the car is controlled via bus scan

You can not buy those unit to Honda (nav and non nav) they just make standart exchange and they control the unit you can have

according ti the vin

you have an hidden menu you can access via pressing menu+power+brightness together (!When the unit is se on home menu), but not really helpfull for the moment

To connect to this usb port, install android studio + driver for tegra (nvidia)

Try to root with oneclic and srsoneclick but no luck for the moment (it's not my speciallity)

Why root ? to have full access to the folder hope to get the garmin hap somwhere or sniff it but as i know there is no update to download

If getting hap should be able to install nav without all those tricky thinks, but not sure because you have alson an id on the unit

have a nice day
[Android Q&A, Help & Troubleshooting] kondormit:
Some news here? [MENTION=721596]Martek[/MENTION] do you have some suggestion about root in [MENTION=7374321]nanddroid[/MENTION] 's case?
[Android Q&A, Help & Troubleshooting] jdmst77:
I'm not sure if anyone else noticed this but if you use the 1.5A USB port, below the radio, you'll have more connection options. The higher amperage port only appears to be used for charging. I haven't had the time to try using this port for adb or telnet but it might work and be easier to access
[Android Q&A, Help & Troubleshooting] nanddroid:
Hello

No ADB access via other usb Just the inside one work. My idea to look inside come from Kenwood unit
[Android Q&A, Help & Troubleshooting] Benchamoneh:
Excellent work [MENTION=2613926]nandroid[/MENTION], have you tried using the Webview exploit? The unit looks to me like it should be vulnerable. Instructions here.

How did you get to the hidden USB port behind the dash? How difficult is it to reach?
[Android Q&A, Help & Troubleshooting] pasen01:
Check this: http://xdaforums.com/general/security/honda-connect-android-t3179549/page19

Anyone with rooting experience that could try this method? Its possible to install an apk successfully on the EU version. However sound (radio,aux,etc) is not working, and not while driving, if you dont disable vsp error every time you boot the car.
[Android Q&A, Help & Troubleshooting] jiggajohn:
they've really got it down on the EU version. Has anyone had any luck with the US version? US version running a newer version of android
[Android Q&A, Help & Troubleshooting] idonteffingknow:
I have a 2016 Civic with the 4.2.2 head unit in it I'm willing to test stuff on so long as you guys walk me through it. I have mild android experience from back in the Gingerbread days. MILD.
[Android Q&A, Help & Troubleshooting] HasibVA:
Has anyone been able to run Android auto on Pilot 2016 US version yet?
[Android Q&A, Help & Troubleshooting] enyce9:
I just purchased a 2017 Honda ridgeline with 4.2.2. need to get apk installation working
[Android Q&A, Help & Troubleshooting] dks99:
the EU side already has a full blown web site with apk files that can be tricked into installing on Honda Connect.

h t t p :// cmhonda.net/tools

does anyone think any tools on that site might help ?
[Android Q&A, Help & Troubleshooting] enyce9:
From what I understand, there has been no progress made on U.S version 4.2.2. I think the only way to get apk installation is to root.....
[Android Q&A, Help & Troubleshooting] enyce9:
Can this help us 2017 Ridgeline, and 2016 pilot owners?

http://www.clarion.com/us/en/user-support/oss-1/
[Android Q&A, Help & Troubleshooting] bighamma:
US version 4.2.2

It's been a few weeks and I thought I would see if any progress has been made?
[Android Q&A, Help & Troubleshooting] theo78825:
Any chance that the newly found Pegasus Trident attack could be used to exploit the android system?

h tt ps://blog.lookout. com/blog/2016/08/25/trident-pegasus/
[Android Q&A, Help & Troubleshooting] wtd03:
Anyone figure out how to root? I have no problem rooting I just want to disable the navigation lock when driving without having to enter servixe menu everytime I start the car
[Android Q&A, Help & Troubleshooting] enyce9:
Not that I know of, I wish I knew more Android development, Im a little jealous of EU Honda owners right now.
[Android Q&A, Help & Troubleshooting] ammarbukhari:
Android Auto for 2016 Pilot

I am in Middle East and my Honda Pilot 2016 has Android 4.2.2. And i cannot install apk.

Please any one has ideast
[Android Q&A, Help & Troubleshooting] j_r0dd:
Anyone have a full dump of all the directories? Been a bit since I've done any work on Android, but just picked up a pilot for the wife and trying to be discreet about poking around in the unit too much. She doesn't want me screwing with this at all lol. I have the EX-L without navi since I got the RES package. After doing some research there is supposedly an sdcard slot in the unit which contains the navigation system if you bought the navi version. Empty if you did not get the navi. It's Honda part 39550-TG7-A01 which I can't find anywhere because Honda discontinued for obvious reasons. I would love to get my hand on one of these. It may help it may not, but it could at least add navi to your system :P
[Android Q&A, Help & Troubleshooting] enyce9:
Not that I know of, I did post a link to source from Clarion's website, I don't think will help tho
[Android Q&A, Help & Troubleshooting] enyce9:
Anyone try KingRoot on computer via USB A to A cable?
[Android Q&A, Help & Troubleshooting] enyce9:
If the head unit can be rooted, what's the possibility of pulling the Android auto apks from the new ridgeline and installing on the 2016 pilot?
[Android Q&A, Help & Troubleshooting] j_r0dd:
If it can be rooted we could install just about anything. My fear is bricking the head unit and getting stabbed in my sleep by my wife [emoji51].
[Android Q&A, Help & Troubleshooting] enyce9:
Hahahahaha, can't blame you there.... I know alot of 2016 pilot owners wanted Android auto and carplay, I own a 2017 ridgeline, which has both, and are willing to try and pull whatever files needed. If only we could crack these head unit...
[Android Q&A, Help & Troubleshooting] j_r0dd:
If you have a ridgeline do a

adb pull -p /* ridgline/

assuming you have a directory named ridgeline in your current directory.
[Android Q&A, Help & Troubleshooting] enyce9:
I'll will and reply back tomorrow
[Android Q&A, Help & Troubleshooting] enyce9:
got a ton of connot copy special file and a sys folder

---------- Post added at 08:26 PM ---------- Previous post was at 08:21 PM ----------

shell@android:/ $ ls

acct

cache

config

d

data

default.prop

dev

etc

fstab.koelsch

init

init.goldfish.rc

init.koelsch.clarion.rc

init.koelsch.clarion.uniq.rc

init.koelsch.rc

init.koelsch.usb.rc

init.koelsch.warp.rc

init.rc

init.synergy.rc

init.trace.rc

init.usb.rc

lost+found

mnt

proc

sbin

sdcard

storage

sys

system

tmp

tmp_database

ueventd.goldfish.rc

ueventd.koelsch.rc

ueventd.rc

var

vendor

version

vrdata

shell@android:/ $

---------- Post added at 09:03 PM ---------- Previous post was at 08:26 PM ----------

not sure if this has any revelance

http://elinux.org/R-Car

googled koelsch

http://elinux.org/R-Car/Boards/Koelsch

????
[Android Q&A, Help & Troubleshooting] j_r0dd:
The pilot also has the koelsch. I am betting they are the same baords and those R-car boards can be bought for a few hundred dollars or it may be time to call the local junkyards. Can you paste a

cat /proc/cpuinfo

Mine returns

shell@android:/ $ cat /proc/cpuinfo
Processor : ARMv7 Processor rev 2 (v7l)
processor : 0
BogoMIPS : 26.00

processor : 1
BogoMIPS : 26.00

Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x3
CPU part : 0xc0f
CPU revision : 2

Hardware : koelsch
Revision : 0000
Serial : 0000000000000000
[Android Q&A, Help & Troubleshooting] enyce9:
shell@android:/ $ cat /proc/cpuinfo

Processor : ARMv7 Processor rev 2 (v7l)

processor : 0

BogoMIPS : 26.00

processor : 1

BogoMIPS : 26.00

Features : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva id

ivt

CPU implementer : 0x41

CPU architecture: 7

CPU variant : 0x3

CPU part : 0xc0f

CPU revision : 2

Hardware : koelsch

Revision : 0000

Serial : 0000000000000000

shell@android:/ $
[Android Q&A, Help & Troubleshooting] j_r0dd:
So these are the same boards smfh honda has no dang excuse for not bringing carplay or android auto. This thing should really be rootable no problem as the boot.img is insecure!

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=0
ro.allow.mock.location=0
ro.debuggable=1
persist.sys.usb.config=mtp,adb
[Android Q&A, Help & Troubleshooting] enyce9:
I checked some fcc documents, i think this will back up your theory about the hardware being the same....

https://fccid.io/document.php?id=2690431

this document might not indicate that ours are the same but clearly you can see they are using the same hardware running different software in different vehicles.

https://fccid.io/AX2

this link will show fcc docs for clarion equipment most of which seem to look identical to ours.
[Android Q&A, Help & Troubleshooting] j_r0dd:
I need to move my router closer to my vehicle. I keep dropping connection trying to pull files. Are you able to pull the system directory and upload?
[Android Q&A, Help & Troubleshooting] enyce9:
I will try, but can't tonight. Will attempt tomorrow and post results. Do you think it's possible to ADB with a usb A to A cable?
[Android Q&A, Help & Troubleshooting] j_r0dd:
probably. iirc the usb port on the left under the dash is the one to use. also if you can get /data/local.prop that would be great. looking at this board there are ways to get in, but that requires ripping the unit out of the dash which I sure as hell won't attempt. the system is more than likely stored on some sort of removable drive from what i can see. i may be wrong completely there though.
[Android Q&A, Help & Troubleshooting] enyce9:
My unit lists an SD card, when in the storage menu in settings..... I tried to access the data folder in shell but was denied access.... I'll try to pull tho
[Android Q&A, Help & Troubleshooting] j_r0dd:
I'm gonna call some junkyards around here. I want the board!
[Android Q&A, Help & Troubleshooting] TWINTRBO:
Probably of no help but I figured you can get the jelly bean thing by tapping the OS version lol
[Android Q&A, Help & Troubleshooting] enyce9:
Try car-part.com it's a listing of junk yards and inventory. I have used it before and purchased from yards found on the site.
[Android Q&A, Help & Troubleshooting] j_r0dd:
Waiting on a quote for the part. I ordered a usb A to A cable as well. I can run

adb root

but get kicked out. I do not get an error, but when I run adb shell I do not get a root shell.

system/xbin/busybox su

returns

su: must be suid to work properly

. My wife is always on the run so I get limited time to play with this thing. I wonder how the dealership updates these units. Let me talk to sales person. He actually does php on the side so he's a little techy. Maybe I can get some info on how they update.
[Android Q&A, Help & Troubleshooting] enyce9:
I have a 5 month old baby, between work and taking care of her at night it's tough to get time to mess around with the head unit. I do have a usb A to A cable on hand I will try it tonight. Oh and someone from the piloteers forum claimed that his friend works at Garmin and stated that in order to access the head unit it must be done by using a usb port in the back of the unit.........
[Android Q&A, Help & Troubleshooting] j_r0dd:
After searching around it looks like as of 4.2.2 there is another prop which allows adb shell as root

ro.adb.secure

and that is what is preventing a root shell. Nevermind that is not set anywhere.

My wife comes home for like 5 minutes at a time. Can't do **** here....
[Android Q&A, Help & Troubleshooting] enyce9:
Hahahahaha I just got home and my wife wants to get her nails done..... Guess I won't be messing with the head unit for a while....

Question about the usb A to A cable, if I hook up my laptop, won't the laptop and the head unit be supplying 5v power out. Isn't there a possibility of shorting one device out or possibly both?
[Android Q&A, Help & Troubleshooting] j_r0dd:
ugh yeah you are probably right about that. i wouldn't take that chance.
[Android Q&A, Help & Troubleshooting] enyce9:
Maybe the guy is right, you have to use a hidden usb port on the back of the head unit.
[Android Q&A, Help & Troubleshooting] j_r0dd:
That is probably the only way in unless someone from honda can leak how to use the boot menu. I see you can boot from usb. Just maybe you can boot from live linux usb and remount the android filesystem to install supersu. idk. I was reading in the honda connect thread about getting stuck in a black screen after choosing one of those boot options even after pulling the fuse...
[Android Q&A, Help & Troubleshooting] enyce9:
Ugh. I found this on eBay, it's multiple pics of the unit. I really don't see a usb port..... Type B maybe printer cable style....

Look at this on eBay http://www.ebay.com/itm/311652794436
[Android Q&A, Help & Troubleshooting] j_r0dd:
If you can upload it all somewhere that would be great. I want to compare what's different at least. I would love to see if Apple car play apk could be installed, but probably need to deodex the system first.
[Android Q&A, Help & Troubleshooting] enyce9:
Yeah, I'll package it up and send you the link when it's done. Probably tomorrow at some point. I know alot of pilot owners are upset about the lack of carplay and Android auto, so I don't mind. My goal is to be able to install other apks on this thing
[Android Q&A, Help & Troubleshooting] j_r0dd:
Yeah root is still the endgame here. I need to decompile that BootModeSelector.apk and see if I can determine what it actually does.
[Android Q&A, Help & Troubleshooting] j_r0dd:
BTW here is the system dump and some of the init scripts from the 2016 Pilot. Still need to figure out which partition is boot.

https://drive.google.com/file/d/0B-DT2Bq_hbLuOXNpOTYzZkRTTzQ/view?usp=sharing
[Android Q&A, Help & Troubleshooting] j_r0dd:
I chose the boot to USB option. Now all I have is a black screen. The cameras function but I can't get back to any options. I'm screwed. Nothing. This sucks.
[Android Q&A, Help & Troubleshooting] enyce9:
[quote name="androyster" post=66966133]Some people mentioned in this thread getting stuck on a black screen after trying some things on their Honda head unit.<br />

<br />

I have a 2016 Pilot EX (US).<br />

<br />

I've tried many different things mentioned in this thread, and was able to get to many different menus and options. I then decided to try the Uploader option in the Boot Mode Select located in the Developer Settings options and rebooted the unit.<br />

<br />

The head unit boots with the HondaLink Logo, but after that, the screen is black (but powered on) and the soft buttons have their lights on. The Laneshift camera and Rear view camera are the only thing that get on that screen. No audio, no phone.<br />

<br />

I tried to remove the 20 Amp Audio fuse to get the head unit to reset, and it is the good fuse, because when I try to start the car again, everything is ok, but the head unit stays off and the cameras of course dont show on the head unit. Tried a couple times to remove the fuse and putting it back after waiting 10 seconds, 60 seconds, even a whole 10 minutes, nothing changes the situation.<br />

<br />

I tried many different combination of keys when the head unit boots, holding power, holding vol + and/or -, holding menu, holding different combos of these keys, nothing more, still black screen<br />

<br />

Any ideas on how to fix this aside from going to the dealer ? I would love to be able to simply do a hardware factory reset, like with an android phone in powered up in recovery mode.<br />

<br />

And I think this will also help anyone who is trying something on their head unit and gets to that black screen dead-end :)[/QUOTE]<br />

<br />

Press cd eject button while drive car then pressure again eject 5 min later HC system will be normal
[Android Q&A, Help & Troubleshooting] j_r0dd:
<br />

<br />

Press cd eject button while drive car then pressure again eject 5 min later HC system will be normal

I have a dvd for RES. Eject does nothing. Looks like I'm going to the dealership tomorrow.
[Android Q&A, Help & Troubleshooting] enyce9:
Ugh, there has to be a way to get back in

---------- Post added at 07:46 PM ---------- Previous post was at 07:41 PM ----------

Can you adb while stuck on black screen?
[Android Q&A, Help & Troubleshooting] j_r0dd:
no adb at all. tried all kinds of button combos. needless to say i'm in the doghouse. should be a 5 min fix at the dealership. it's not like it's bricked. just don't know how to get out of that mode.
[Android Q&A, Help & Troubleshooting] enyce9:
I wonder what a pulling the battery would do....
[Android Q&A, Help & Troubleshooting] j_r0dd:
I tried to just pull the fuse. Didn't help. I have to go to the dealership in the morning anyways in the morning to sign some paper they forgot about. Just gonna have them fix. I definitely won't be messing with this any further.
[Android Q&A, Help & Troubleshooting] enyce9:
Ugh, if / when they get it working again, try and find out what was done.
[Android Q&A, Help & Troubleshooting] j_r0dd:
Something I just thought of is that the usb drive I made wasn't an arm distro, which is probably why it never booted to anything. There is a factory reset shell script in the etc dir. Maybe I will play with a tiny bit more in the am.
[Android Q&A, Help & Troubleshooting] enyce9:
Could be. Question : when you pulled the fuse did you see the touch screen go dark? Even if it did I wonder if there is a constant 12 v going into the head unit from the canbus....... A total battery disconnect should initiate a radio code input or a vin number check in the radio.
[Android Q&A, Help & Troubleshooting] j_r0dd:
yeah the head unit turned off. too lazy to disconnect the battery. i think there is probably some temp file or flag somewhere telling the unit where to boot to. digging around now.
[Android Q&A, Help & Troubleshooting] j_r0dd:
Pulling battery doesn't fix. They are re-flashing firmware. Oh well.

---------- Post added at 01:28 PM ---------- Previous post was at 01:12 PM ----------

By the way it is on a USB stick. All he did was put it in the left slot under the dash while car was off and then tap the start button twice. It started uploading firmware on the screen. Need that USB drive rofl!!!
[Android Q&A, Help & Troubleshooting] enyce9:
Someone has to either work for honda or know someone who works for honda on this forum.....

---------- Post added at 01:50 PM ---------- Previous post was at 01:49 PM ----------

I guess they didn't question how it happened... Lol
[Android Q&A, Help & Troubleshooting] j_r0dd:
No question at all. Supposedly there is a service bulletin for the head units going black on multiple models. Their fix is to update firmware. Bottom line is these units are extremely locked down as far as the software goes. Sure you can disassemble the unit and have way more options to get in there. Even if you get a copy of one of those USB sticks you might be able to mod the software or it could still be encrypted though.

Another thing he said to a fellow mechanic was he didn't have to do anything to get into the update mode. He said he just had to turn on the car. This makes perfect sense from what I saw in the Java code for the ProgramUpdateApp.apk. Boot from USB option is not like choosing a boot option for a computer it is how it will be updated.

pastebin.com/b5ZCnjt0

Either way I am not ****ing with my unit anymore unless there is some sure fire way. I can also see why Honda won't be updating our units too. It took about an hour for my head unit to update. Let's say there are only 100,000 2016 pilots out there. Labor 90/hr. That's $9,000,000 it would cost them to update every pilot. BS they don't let us update our units ourselves like other manufacturers.
[Android Q&A, Help & Troubleshooting] enyce9:
Did the update the firmware? Or reflash what you had originally? I don't blame you for not wanting to mess with it anymore. Happy wife happy life. Lol
[Android Q&A, Help & Troubleshooting] j_r0dd:
Honestly it probably just re-flashed. I was playing dumb.
[Android Q&A, Help & Troubleshooting] enyce9:
Somebody claimed to have what he believed to be the firmware, 750mb. I forget where I saw it....
[Android Q&A, Help & Troubleshooting] enyce9:
i forgot to ask , did you take a look at the files on clarion site?

http://www.clarion.com/us/en/user-support/oss-1/
[Android Q&A, Help & Troubleshooting] jersacct:
New 2016, non-Nav owner here and very interested in getting some other apps to run. I'm handy with ADB and APK decompiling, but smali is a mess. I've snagged/decompiled the DealerDiagApp.apk, which from what I can tell is responsible for saving and importing the user configuration data (which might enable things like CarPlay and Android Auto).

Anyone here good with smali to reverse engineer the DA_USER_DATA.xml checksum, or need some help pulling files off a non-Nav system?

Cheers,

Jeremy
[Android Q&A, Help & Troubleshooting] j_r0dd:
I have dug through it a little bit. Not thoroughly though. Will dig around some more when I get some time. It would be nice to know how to get out of those boot modes.

---------- Post added at 09:14 AM ---------- Previous post was at 09:04 AM ----------

You can use dex2jar to get the java code. I already posted a full system dump a few posts back. You can't install apps on this thing period without root. The 2016 pilots do not have the CarPlay.apk where the 2017 Ridgeline does, but there are also other files like /system/etc/airplay.conf that I can almost guarantee to be needed. Bottom line is get root then you will have a chance of making changes.
[Android Q&A, Help & Troubleshooting] enyce9:
There has to be a way.... Does anyone know what the take snapshot option does. Could it be possible that option will upload a backup of the system on usb drive, that you could then boot in uploader mode....?