yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] kyle_wils:
Boot from system loader - screwed up

Changed colour settings now when vehicle starts up. Android OS doesn't boot. However the menu buttons all still light up and back up camera and blind spot assist still works.

Help!!! I tried:

Pulling negative terminal. Didn't help.

Pulled stereo fuse hoping factory reset. Nope.

Tried android boot menu (power plus volume down) at start up. Nothing

Any advice? Did I brick it? There has to be a way to factory reset with access through options as it simply won't boot.
[Android Q&A, Help & Troubleshooting] uid6011:
The USB let's you install things. BUT the things on the USB have to be certificated.

The dealers have update files to make some little changes to the system. It was a little service bulletin.

They just plug it in and it asks if you want to flash the system.

The files are zipped and cointain a .enc file that has the full android system. The file is around 750mb. Depends if the system is with navigation or not.

This goes for the EU versions atleast. Dont know about the US versions.

IF someone has good experience with that kind of things PM me.

I have the files for both navigation and without navigation.
[Android Q&A, Help & Troubleshooting] Martarek:
Just to be clear, what model of car is it for and what year? The civic or the Pilot? Does it even matter? Nice finding by the way!
[Android Q&A, Help & Troubleshooting] uid6011:
The files are for all Honda Connect devices. Civic, HR-V, CR-V, Jazz.

One little more thing.

If someone has a car with android auto and no navigation. Follow these steps:

1. Disable the VSP error in the hidden menu

2. Make a wifi hotspot with your phone

3. Open this link in your browser - dev.ffwdmejs.org/demo.html?debug=true (put http in front)

4. Allow the browser to use your location.

Can't remember if i enabled something also in the android settings but if it does not work try to find something with allowing to use your location.

All the EU models come with a built in GPS module.
[Android Q&A, Help & Troubleshooting] cfmano:
Thank you for some piece of advice where to look for. I've tried this one, using metasploit for developers, unfortunatelly got:

[!] 192.168.43.148 webview_addjavascriptinterface - Exploit requirement(s) not met: vuln_test. For more info: ht tp :// r-7. co/ PVbcgx
[!] 192.168.43.148 webview_addjavascriptinterface - No vulnerable Java objects were found in this web context.

So even though, the version of the system being stated was 4.0.4, the browser has already beed fixed, probably.

I've also tried to nmap ports through wifi LAN using my cellphone as a hotspot, but nmap says that all ports in range 1-3000 are closed and all in range 3001-13000 are filtered. I have no idea why it was filtered - maybe my phone blocks some ports (or there were too much scans at once). Maybe I'll try it again in smaller chunks.

So I will try to find the other types of vulnerabilities you mentioned and let you know.

But there is one thing I can't figure out. The system suppose to support USB debugging, bug it has only USB-A female connectors available, so It will work only as a host in this configuration. Is there any chance to connect 2 devices that has only this types of USB ports available and still be able to debug it?

Thanks for the inspiration :)

---------- Post added at 11:45 PM ---------- Previous post was at 11:41 PM ----------

750MB file looks like a whole new firmware and OS. ".enc" probably says it's encryped, so it could be hard to find out the real content of the files.
[Android Q&A, Help & Troubleshooting] Martarek:
Can't say I am surprised. But was worth the shot!

I would not be surprised that the results are from having scanned the radio through a mobile-phone hotspot. I've looked around and some users have experienced problems with port not being forwarded properly when using this type of setup (which seems optimized for mostly web browsing). In any case, if you could try this using some standard router, the results might not be the same. Also, I do not know what parameters you used for your nmap but it could be necessary to force it to scan all TCP and UDP ports . Let me know if you try it.

I honestly think that the StageFright vulnerability might give the better chance. Let me know if you try it.

No clue. Maybe they used ADB remote debugging functionalities? Is there such a thing available from the dev menu? It is standard on Android phones, but I do not know if they exported it on the radio as well. I've been told that the USB connector can be used to update the firmware by simply connecting a USB key with the right files on it.

I confirm, the 750 MB file is encrypted, I can't find out what with. The most likely candidate is RSA-2048 as there is a .dat file that has exactly 2048 bits with the same name in the .enc file, which could be the file signature, public key, salted private key, or anything else for that matter. The missing half for decryption could be built-in the radio for all I know... It's a dead-end at the moment on my side.
[Android Q&A, Help & Troubleshooting] wcjkd:
Please keep working on the Android sys for the 16 pilot. There are a lot of ppl anxious to be able to access other applications of possible.
[Android Q&A, Help & Troubleshooting] Martarek:
There is still the stagefright vector to test and a complete port scanning of the device using nmap to be done which could give an idea on our options. As I said, I do not have the vehicle myself, so I cannot do it but am willing to assist!
[Android Q&A, Help & Troubleshooting] steven817817:
HONDA CRV

My family has a new Honda CRV and it has the android radio and navigation i'm pretty sure. It is annoying that you have to stop to use the navigation in it. I would like to remove that. Also adding some apps or youtube or something with video would be awesome. We haven't done any updates to it at all yet. What should I do that would possibly assist in figuring out the system?
[Android Q&A, Help & Troubleshooting] trent99:
I'll try running nmap and will return with the results
[Android Q&A, Help & Troubleshooting] Martarek:
Great! I'll look into the results as soon as you post them. An important thing to do would be to make sure that you use a standard router and not a hotspot as a connection point. This will ensure that reports of ports closed or filtered are not due to a filtering done by your network configuration and not the car radio itself. Also, make sure that no special security functionality is configured to prevent port scanning of the device.
[Android Q&A, Help & Troubleshooting] trent99:
Only port that I saw open from my scan was 5555
[Android Q&A, Help & Troubleshooting] Martarek:
Wow, that is the remote ADB default port. Could you try a Telnet connection to it and also connecting through remote Adb on it?
[Android Q&A, Help & Troubleshooting] jdmst77:
I'm getting a little tired of turning off the Diver Distraction "feature" every time I shut off the engine. Can't wait to root it.

If it's any incentive, before I bought my 16 Pilot, (knowing that the stereo wss Android) I asked questions about the radio like... "what if the radio doesn't power on? What if the radio has some strange error or doesn't work correctly?" I was told that it would be covered under the standard Honda warranty. This was from a sales man so trust what you will... Can anyone confirm or deny this coverage?

I really want to get AllCast Receiver running on it so I can cast Showbox, YouTube, and a bunch of other apps.
[Android Q&A, Help & Troubleshooting] Benchamoneh:
I have both a CR-V and a Euro Civic Sport hatchback (both registered in 2015, no sat-nav) available to test. I ran nmap on them earlier today using a DD-WRT based router to provide the WiFi network.

First I attempted to connect to each car via ADB, but this gave me an unusual response I'd not seen before:

>adb connect 172.16.0.241
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
[B][I]empty host name[/I][/B]

>adb kill-server

>adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *

>adb connect 172.16.0.241
unable to connect to 172.16.0.241:5555

The first connection attempt was rejected because apparently the hostname isn't set on the device. A quick Google brought up a result with the options of either restarting the local service, or setting the hostname first via USB. Obviously USB is out so I attempted to restart ADB but after this I was never again able to connect to the car.

Nmap results were a little inconsistent to say the least, apparently neither vehicle has any TCP ports open! I can only assume that my connection attempt killed the service in the car but removing/replacing the key didn't bring it back to life.

Results here for Civic and CR-V.

Admittedly I only ran the scan on the first 10000 TCP ports and didn't investigate too much (it was raining and I didn't want to be outside too long :( ). I can re-run tests or extend if people would like.
[Android Q&A, Help & Troubleshooting] trent99:
I was able to connect via remote adb tonight. I didn't try to run any commands aside from 'adb' which returned the help info. Telnet didn't seem to work. It kept saying socket closed by server or something like that. Let me know if there's anything more I should try with adb. Thanks
[Android Q&A, Help & Troubleshooting] jdmst77:
If you can successfully use adb, try

adb push file.apk /tmp/file.apk

adb install /tmp/file.apk

If you are able to install an apk, there may be a possibility of installing a root exploit tool like Towelroot or KingRoot
[Android Q&A, Help & Troubleshooting] HitFactor:
FYI, I have a 2016 Honda Pilot EX.

This is a summary of what I have learned following links in this thread.

To enter maintenance menu press and hold the green Audio (power), menu, and brightness buttons at the same time.

This brings up another menu. Tap on Detail Information & Setting.

Tap the menu button and this takes you to Developer Diagnosis Top menu.

Scroll down to Driver Distraction and tap the button. Change to off.

Tap home button. You can now use the browser while in drive. If you shut off the engine this will revert back to driver distraction on.

In the browser I went to google maps (tethered to my S6 hot spot).

As I drove about my location did not update. I changed a few settings in android location to no avail.
[Android Q&A, Help & Troubleshooting] Martarek:
Nice! Do you have a screenshot of the successful connection? As for the commands, if

adb push <anyfile>

adb shell <any command, for instance : echo "I work">

both works, I may have a pretty definitive idea for rooting it without installing any APKs. Keep me posted!
[Android Q&A, Help & Troubleshooting] trent99:
I was able to write to the sdcard folder but couldn't install from there. It said invalid apk. I tried copying over another apk that was already installed to be sure that it wasn't the apk.

Shell did work. I tried doing a chmod on the sdcard directory but it didn't work.

I couldn't write to system and didn't try any others besides sdcard. I can post the remote files if you're interested and I also copied the results of mount. I'm not sure what to do at this point so please let me know if there's anything else I could try.
[Android Q&A, Help & Troubleshooting] Martarek:
The SDcard on Android does not allow execution, so chmod fails, no matter the privileges. There is usually a folder located at /data/local/tmp that on nearly all systems can be used for dumping and running files. Can you try to locate the folder? If it has it, a chmod would work there, so we could use this way to upload a rooting binary such as :

https://github.com/timwr/CVE-2014-3153

It may need adaptation or additional steps but if you get there, it should not be too hard!

---------- Post added at 08:58 ---------- Previous post was at 08:16 ----------

Btw, what is the vehicle on which you are running the tests and could you post the steps you used to successfully connect to adb?
[Android Q&A, Help & Troubleshooting] trent99:
2016 Pilot

1. Connect car to Wi-Fi router (System -> Bluetooth/wifi)

2. Write down ip address of car (in Wi-Fi options)

3. On pc also connected to router: adb connect <ip-address>

You should see the pc window say connected. I can't remember if I had to put port 5555 in the adb connect command. I'll check it again later when I look to see if I can write to data/local/tmp
[Android Q&A, Help & Troubleshooting] Martarek:
Awesome thanks! Was your router connected to the Internet? If you manage to do it, I'll see what I can do to for the rooting binary, I've had experience with it from past projects.
[Android Q&A, Help & Troubleshooting] trent99:
Yes, it was connected to the internet. I connected again tonight and was able to access /data/local/tmp. I pushed a file and created a directory. I did chmod on the directory and it seemed to work. Also, I had to specify the port in the adb connect command:

adb connect 192.168.0.2:5555

Let me know if you want any more info, I can pull files or run other commands if you need me to check anything. Thanks so much for helping.
[Android Q&A, Help & Troubleshooting] Martarek:
Given that the device is most likely vulnerable to the Futex requeue exploit (i.e. TowelRoot) and that you have a shell access to the device, can upload files and chmod them, I believe it should be feasible to root it from there. I'll see if we are lucky enough to have the default TowelRoot exploit work out-of-the box for us.
[Android Q&A, Help & Troubleshooting] kondormit:
Let us know when you have binary, I can try also on my car.
[Android Q&A, Help & Troubleshooting] Martarek:
EDIT : Removed the attachment. Caused freezing on the Android Radio. Needs to be adapted.

First a little disclaimer : Use at your own risks! I cannot test it as I do not have the vehicle.

Here.

Recommended : newroot.bin.zip is the TowelRoot exploit compiled as a binary from

https://github.com/timwr/CVE-2014-3153

The compilation (which I won't detail) is pretty straight forward if you feel better at having a binary you compiled yourself (I know I do =P ).

You could also try the binary proposed by :

http://xdaforums.com/android/software-hacking/towelzxbin-binary-towelroot-root-shell-t2818848

which uses part of the official TowelRoot lib by GeoHot to do the same thing. I do not know what is inside this launcher as the source code cannot be found so I cannot vouch for its authenticity.

Among the possible behavior there is :

Provide a Root Shell (yay!) . When you quit the root shell, the device will reboot within 10 seconds.

Cause the device to reboot (you may have the shell for a split second before the reboot). If it is so, the device can be rooted this way but the exploit has to be adapted.

Freeze the device and require to disconnect the car battery to reset the radio.

Brick the device (highly unprobable as towelroot does not modify anything but the volatile memory (RAM) of the device. Still, I had to disclaim it as we are wandering into uncharted lands so we never know!)

From my experience, the reboot could take a second or two before occurring. If so, it should be long enough to launch an automated bash script that will permanently root the whole thing. If it freezes the system, it could be possible that the power must be removed from the device to reboot it properly (i.e. disconnect battery, wait a bit and reconnect it). Since I cannot test it myself, I do not know what may come out of it, but if you're willing to try it, I have attached a zip file containing the binary. To run :

Push to /data/local/tmp

chmod to give executable permission (770 or 777)

launch data/local/tmp/newroot.nopie from a shell onto the device.

Pray/hope/tapdance your way to a working root shell!

Good luck!
[Android Q&A, Help & Troubleshooting] kondormit:
I just tried, and was unable to connect via adb. I was using hotspot (android and iOS), so maybe this is the problem.

Also, I was unable to enable developer mode, maybe this is the problem? I was tapping on build number but without success.

Will try tomorrow morning MiFi as router.

I have 2015 euro civic (hatch)

Edit:

I just tried with MiFi router, the same:

Will try today with some real router, and let you know.
[Android Q&A, Help & Troubleshooting] pasen01:
I think you need to enable developer mode in the special menu accessed by the button combination.

For the Developer mode you'll first need to get into the Diagnostics system, the key combination varies but on my model from the head unit you press and hold the Menu + Power + Brightness buttons / touch area. Hold them for a few seconds and you get 2 options, 1 to run a full self-diag and the 2nd option to view the diag settings.

There is a menu called Functional Setup, from here you can enable Developer mode, which then restores the Android developer settings in the usual Android settings area.

If the*key*combo*doesn't work you could also try

Home + Power + Brightness

Menu + Power + CD Eject
[Android Q&A, Help & Troubleshooting] kondormit:
Ok, got developers menu. Thx [MENTION=7340860]pasen01[/MENTION] !

Will try later to connect.
[Android Q&A, Help & Troubleshooting] jvilla785:
i tried your binary and the headunit froze then after a while rebooted the headunit. Tried the other 2 binaries from the other thread and they both rebooted the headunit.
[Android Q&A, Help & Troubleshooting] pasen01:
You can perform a "hard reset" by holding the power button for 10 sec. Like any other Android device. IF it prompts for a password/theft code on boot, just turn ignition on or start the engine.

The headunit is paired with the ECU i belive.
[Android Q&A, Help & Troubleshooting] Martarek:
Sorry, exploits aren't the most reliable things to work with. I removed the binary file to avoid more trouble to anyone else.

On the plus side, it means the exploit is viable but needs to be adapted. Maybe the towelzxbin from the other forum post might work as it uses the last library released by GeoHot with modstrings (allowing more flexibility for the exploit to work). My guess is that the memory offsets are different and would need to be accordingly changed. Sadly, this is rather hard to do blindly. I'll keep thinking about it and will get back at you if I get another idea.

EDIT : A dumb one, Anyone tried "su" inside the shell, just for the fun of it? It couldn't be that easy but still, had to ask.

---------- Post added at 15:51 ---------- Previous post was at 15:37 ----------

A glimmer of hope?

https://github.com/android-rooting-tools/android_run_root_shell

Seems like a binary toolsuite to root about anything. I'll look into it when I get the time.
[Android Q&A, Help & Troubleshooting] jvilla785:
"su: not found" also your binary eventually reboots the device.
[Android Q&A, Help & Troubleshooting] Martarek:
Could anyone run those :

Inside a the Android shell? At least I could have an idea of the underlying chipset of the device =)
[Android Q&A, Help & Troubleshooting] jvilla785:
This is from a 2016 honda pilot non navi unit

cat /proc/cpuinfo

Processor	: ARMv7 Processor rev 2 (v7l)

processor	: 0

BogoMIPS	: 26.00

processor	: 1

BogoMIPS	: 26.00

Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt

CPU implementer	: 0x41

CPU architecture: 7

CPU variant	: 0x3

CPU part	: 0xc0f

CPU revision	: 2

Hardware	: koelsch

Revision	: 0000

Serial	: 0000000000000000

cat /proc/meminfo

MemTotal: 933568 kB

MemFree: 126604 kB

Buffers: 9752 kB

Cached: 181036 kB

SwapCached: 0 kB

Active: 489784 kB

Inactive: 128828 kB

Active(anon): 427976 kB

Inactive(anon): 2764 kB

Active(file): 61808 kB

Inactive(file): 126064 kB

Unevictable: 0 kB

Mlocked: 0 kB

HighTotal: 311296 kB

HighFree: 660 kB

LowTotal: 622272 kB

LowFree: 125944 kB

SwapTotal: 0 kB

SwapFree: 0 kB

Dirty: 0 kB

Writeback: 0 kB

AnonPages: 427764 kB

Mapped: 162068 kB

Shmem: 2916 kB

Slab: 27216 kB

SReclaimable: 7596 kB

SUnreclaim: 19620 kB

KernelStack: 11344 kB

PageTables: 18532 kB

NFS_Unstable: 0 kB

Bounce: 0 kB

WritebackTmp: 0 kB

CommitLimit: 466784 kB

Committed_AS: 11916152 kB

VmallocTotal: 385024 kB

VmallocUsed: 97180 kB

VmallocChunk: 195524 kB

/system/bin/sh: free: not found

cat /proc/version

Linux version 3.4.67-ltsi (si_test@NSI-003) (gcc version 4.7.4 20130903 (prerelease) (Linaro GCC 4.7-2013.09) ) #1 SMP PREEMPT Sat Sep 26 10:30:05 JST 2015
[Android Q&A, Help & Troubleshooting] kondormit:
Unable to connect even with developer options enabled :/

Last thing which is left to try is with full featured router, not mobile phones.
[Android Q&A, Help & Troubleshooting] jvilla785:
i didn't need developer options enabled to connect with adb.
[Android Q&A, Help & Troubleshooting] kondormit:
Does it work for you if you use phone as a hotspot or you are using your house router?
[Android Q&A, Help & Troubleshooting] jvilla785:
using my house router. haven't tried using my phone as a hotspot.
[Android Q&A, Help & Troubleshooting] Martarek:
A phone as a hotspot can sometimes prevent usage of certain ports. So it is possible that this may be your problem. However, it is possible that only 2016 model have this enabled. To be seen!
[Android Q&A, Help & Troubleshooting] Martarek:
I wonder, does the command

works? If so, what about with different switches?

From the documentation

It could give information on what is installed onto the device and even provide local unencrypted versions...?
[Android Q&A, Help & Troubleshooting] jvilla785:
adb backup -full

Now unlock your device and confirm the backup operation.

no diaglog pops on my headunit to confirm the backup.
[Android Q&A, Help & Troubleshooting] kondormit:
It would be great to figure out how Android Auto and CarPlay are integrated into 2016 US devices, maybe its possible to "copy" them into 2015 EU devices which are without them.
[Android Q&A, Help & Troubleshooting] jdmst77:
Anyone try KingRoot instead of TowelRoot?
[Android Q&A, Help & Troubleshooting] Martarek:
Wouldn't work. KingRoot is an Android application that needs to be installed. The installation of apps is locked and controlled on the vehicle radio unless it is a special encrypted apk from Honda (*.hap) . TowelRoot exists as a compilable binary and could be run directly from a shell cmd.
[Android Q&A, Help & Troubleshooting] jdmst77:
I didn't realize that was the requirement with installing an apk on the device. I'm not sure if it's already been tried but I remember the later versions of TowelRoot giving the options to enter different modstrings. I'm not sure what they would be for this device but it might be something to try if it can be accessed via adb shell

Here's some details regarding the modstrings:

https://towelroot.com/modstrings.html
[Android Q&A, Help & Troubleshooting] pasen01:
Maybe a longshot, but have anyone tried installing a normal apk with adb on the device?

Too easy if this would Work...
[Android Q&A, Help & Troubleshooting] kondormit:
Yes, and installation fails. Read previous pages, honda has encrypted hap file which contains apk inside.
[Android Q&A, Help & Troubleshooting] pasen01:
Yes i know. I just thought adb install as a "developer" might differ from the GUI installation that you normaly would run... As i said, longshot.
[Android Q&A, Help & Troubleshooting] Martarek:
Same, towelroot as distributed on this website is an apk. The binaries included are heavily obfuscated, making it hard to use the lib without knowing what needs to be done. This path was explored in previous posts btw ;) . There is a launcher that uses the latest of towelroot but is not open-sourced and did not work either.
[Android Q&A, Help & Troubleshooting] kondormit:
On my device there is some "Install app" application, which search for specific file (hap I think) on external storage.

Maybe we can get this app directory and analyze it? Maybe we can figure out how its crypted...
[Android Q&A, Help & Troubleshooting] durik:
Hello,

here is some info about those .hap files and application that is instalable.

http://xdaforums.com/general/security/honda-connect-android-t3179549/page11

HondaAppCenter.apk and ApplistUpdate.apk those files can be modified from this link: [h t t p s : / / yadi.sk/d/q7UyO8d6i39KL]