[Security Discussion] k1000dbw:
Step By Step Tutorial

Ok Here is a Step by Step Tutorial on how I have been able to install any application on my Honda Connect RC7 .

Disclaimer: I am not responsible of any damage this could make to your device. Do it at your own risk. The only thing I know is that it worked fine on my RC7 unit… I hope this could help you to install application on your head unit.

How to check your version :

Go to the android parameter and click on About this device . You should find Build Number : 0F.095.01.1123. Ok You have the RC7

[IMG="Version Check"]https://i.imgur.com/RfWGzkE.jpg[/IMG]

What you need:

A – Hardware:

1/ USB OTG Cable - Female A to Micro A ( https://www.sparkfun.com/products/11604 )

2/ USB A Male To A Male Cable ( https://www.amazon.com/DTOL-Feet-USB-Male-Cable/dp/B000BSJFFC )

3/ Screwdriver philips ph00

B – Software:

1/ iRoot

2/ Honda Permission from S_Mike

Here is the files I used: https://www.dropbox.com/sh/hl4egyh1x49y14r/AABd2cZYYzmh6Mt0MPQcE9Mea?dl=0

Step One: Preparing your computer and the iRoot software.

Before everything, I have installed the Intel Android Drivers (not sure it is important but …)

A/install iRoot on your Windows computer

B/Go to the install directory of iRoot ( in my case this is c:\Program File (x86)\iRoot\ )

C/There you should find a directory ( in my case this is \1.8.9.21144) which contain kinguser.zip

D1/ Easy Way : Replace it with the one I have included in my dropbox link.

D2/ Hard Way : edit the kinguser.zip file and replace the kinguser.apk with the application that you want to inject. In this case we want to inject the Honda Permissions application from S_Mike. I have downloaded the one from cmdroid.com that’s why it is HondaAppCenter_A1.apk. Just rename it as kinguser.apk and replace it in the kinguser.zip

Step Two: Connecting the device to your computer

1 – Enable the Developer Option

A/start the device

B/Press and hold "MENU"+"Day/Night"(Brightness)+"POWER" button (in this order) for about five seconds until the display changes

C/Select "Detail Information & Setting"

D/Select “Functional Setup”

E/Select “Developer Option Enable”

F/Select “On” to enable the developer option menu.

G/Push Return to come back to the Welcome screen

2 – Enable the USB Debug mode in the developer option Menu

A/Go to the Android settings.

B/Select Developer Options

C/Tick USB Debugging. ( I have also tick the Stay awake but I don’t think it would change anything…)

3 – Connecting the device to the computer

A/Flip the screen (push the eject button)

B/Unscrew the 4 screws which hold the screen

C/Get the screen slowly out (it could be tighten but mind the ribbon cable of the screen !)

D/Hold the screen with one hand and use the other hand get the plastic cache ( just above the ribbon cable) out.

E/Use something to support the screen.

F/ Now that the screen is raised, you can access to the micro USB Type A port.

G/Plug your cable in that port

Step Three : Inject the Honda Permission application

A/Start iRoot

B/Plug the cable to your computer and you should see

C/Wait until this

D/Click on Root

E/Wait ( The sound of your head unit might stop sometimes)

F/Now you should have that screen and your unit should restart.

G/After restart you should find the Honda Permission installed.

Step Four : Installing any application

A/Start Honda Permission

B/You can Edit the HondaAppcenter_A1.apk (leave your finger on it until the pencil arrives on the top right side of the screen)

C/replace the “Sig digest sha256” with PREINSTALL value

This should activate the “HondaAppCenter_A1.apk” BackDoor.

BUT in my case The Install button was still greyed out…

Here is my solution:

A/ Start Honda Permission

B/Click on the + button in the Allowed Installations menu

C/Create a new rule with :

•	APK Name : application.apk

•	Package name:

•	Sig digest sha256 : PREINSTALL

D/Now you can install any application that you have renamed application.apk.