yashsingh1/xdaforums huggingface dataset:
[Connected Car] fuzzyy@:
Hello,

I want to activate the wifi on the uconnect. It does not work.

My uconnect 8.4 / firmware 15.26.1

1. I downloaded the ISO for MY14-15 Cars

2. on the USB stick swdl.iso, script.lua and disableDRM

script.lua:

#!/usr/bin/lua
local os = os
-- copy patched disableDRM
os.execute("mount -uw /fs/mmc0/")
os.execute("cp -f /fs/usb0/disableDRM /fs/etfs")
os.execute("chmod 555 /fs/etfs/disableDRM")
-- remount mmc0/1 as read-only mode
os.execute("mount -ur /fs/mmc0/")
os.execute("/usr/share/scripts/mmc.sh stop")
-- stop mmc mount and end script

after the update the swdlLog.txt is generated.

swdlLog.txt:

********SOFTWARE UPDATE LOG********
Starting Update
Total units to update: 12
Installing unit 1 SYSTEM CHECK
Got the unit installer for SYSTEM CHECK
System market mismatch, stick contains NA but target is EU
System Market matches
System Product matches
Script Started.
ERROR: Script finished
Software Update failed, see 'swdlLog.txt' on the USB stick for more details
Eject USB for RESET

whats going on here?

as if the script would not be executed?

please, help me...:(
[Connected Car] devmihkel:
Perhaps the script runs alright (do an echo or something in your script to your /fs/usb0/ to test), but disableDRM trick has no effect on mine MY16 - so maybe it's just no good for your 15.x firmware anymore neither, I wonder...

(I still get the same "No Active Subscription..." prompt with or without disableDRM file in place, nor can I see any occurance of this string in 16.x ISOs).
[Connected Car] fuzzyy@:
Hello,

It is possible that there is no wifiunit in the EU uconnect device (german 2014)?

Now, i have access to the partition mmc0 and mmc1. I patched the media.sh "touch /fs/etfs/disableDRM &" , but there is only the normal settings button, no new one with wifi after reboot.

know one more about the eu uconnect device or still missing an entry for wifi?
[Connected Car] devmihkel:
Use the script to check if hardware is there "ifconfig > /fs/usb0/ifconfig.out" or similar, "uap0" network device should be listed as WLAN interface.
[Connected Car] fuzzyy@:
type "ifconfig > /fs/usb0/ifconfig.out" in lua script.

the ifconfig.out is generated after reboot but is empty. no entry

:confused:
[Connected Car] devmihkel:
hmm, imho at least "lo" device should appear, mine goes something like this:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33192
inet 127.0.0.1 netmask 0xff000000
pflog0: flags=100<PROMISC> mtu 33192
uap0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
address: bc:30:7e:
media: <unknown type> autoselect
inet 192.168.5.1 netmask 0xffffff00 broadcast 192.168.5.255

Perhaps some other info can be extracted e.g.

os.execute("pidin info > /fs/usb0/pidin.info")
[Connected Car] Leighm0:
Just adding a DisableDRM file does not actually enable the Wifi App, you need to enable it first - this is just to bypass DRM checks... which are only valid on older firmware now days.. you will need to hack SWF files to ignore DRM checks now days.

---------- Post added at 02:07 PM ---------- Previous post was at 02:06 PM ----------

Correct.. the script runs, and the Error is to bomb out the REAL upgrade scripts.. i.e. dont flash the device back to 14.x.. reboot.

---------- Post added at 02:26 PM ---------- Previous post was at 02:07 PM ----------

Same as above.. Wifi App doesnt show up just by having disableDRM.. you need to enable the Wifi app..

Easiest I have found was to modify this file: /dev/fram/productid

It looks something like this in hexeditor:

VP3_RW_MY14_REVB_N_N_N<hexchars>

I converted mine to be: (VP4 got nav by default, VP3 doesnt)

VP4_RW_MY14_REVB_E_D_N<hexchars>

Those last 3 letters after "REVB" tell the vehicle what is installed.

Character one (Wireless/Cell phone module):

E = ECell (Embedded Cellular module.. for some reason this turns on Wifi AP)

N = Nothing

Character Two (Radio type):

D = DAB radio

S = Sat radio

N = Nothing (just normal am/fm radio)

Character Three (dont recall what it was).

N = Nothing..

I dont even remember where I found out what the values were, but it would have been dumping the .sh and .lua scripts from the unit and reading through them, also the SWF menus.. working out what the unit was looking for in this file, to turn on certain functions. (the boot.sh was the major detail of this, also there is a few wlan.sh and other scripts..)

FYI - my AU vehicle should not have wireless device, or the cell module (it doesnt physically have the Sierra Card), but it still uses something for the wireless AP - which is fully functional.. however quite useless apart from gaining SSH access over wifi.

You can see a lot of the scripts on the vehicle without gaining access by looking on the original FW isos... folder called "usr\share\MMC_IFS_EXTENSION\bin" has a lot of .sh and lua scripts which tell you how it loads up stuff at bootup...
[Connected Car] devmihkel:
Hi Leighm0, absolutely interested to check some of these links of yours, if it would be possible to try out ready-made NaviServer2 binary for testing. Have you managed to try this combination (custom binary + fresh iGo maps) on 16.x software version as well?
[Connected Car] Adzy86:
Hi Guys

Very interested in this thread

I have a MY16 Cherokee KL with the UConnect (RJ4) running v17.43.01

Living in Australia we don't get alot of features in uconnect and map updates seem to be non existent?!?

So getting android auto, or even a 3rd party map application installed would be very handy.

Thanks

Adam
[Connected Car] markkpatel:
Here is a link if you want to add Off-Road Pages app.

1. Copy the f1de6bac-9876-3250-8dc2-c729b755a600 folder to /fs/mmc1/xletsdir/xlets folder

2. Copy the OffRoad_config file to /fs/etfs folder.

3. If you get the DRM message then run command os.execute("touch /fs/etfs/disableDRM"). You only need to do this once. This creates an empty file at /fs/etfs/disableDRM

If like me you do not get SelecTerrain data then you can also copy the 600X folder to the xlets folder. This is a copy of the app that I modified to default the SelecTerrain mode to ROCK. So you will at least get to see a nice image on the SelecTerrain page.

https://mega.nz/#!6LxyhCaA!ZY9av1I0mYYUxd4p8mIIlA_JohNaRR1WtoAwkQfJUq8

Goto page 17 and read till page 19 for updated data on ORP app:

Rooted Jeep Cherokee '14 uConnect

DISCLAIMER: Doing anything i describe in this thread is at YOUR OWN RISK, if your Jeep suddenly dies on the highway im not responsible, but if your jeep magically gets 200 MPG or limitless fuel i take full credit :) So studying the white paper...

xdaforums.com

For those that would like to try and fix this issue, the relevant items are:

konax.io.Connector

konax.sensors.ChannelInfo

konax.sensors.Data

konax.sensors.MeasurementRange

konax.sensors.SensorConnection

konax.sensors.SensorInfo

The app is looking for sensor "GlobalDriveModeStatus".

Thanks,

Mark. ( 2015 JGC Summit v16.13.13 )
[Connected Car] devmihkel:
Yes indeed, that Naviserver2 binary works fine with updated maps also on MY16 and 16.33.29.

(to my surprise, as it seems to be of VERSION=9.10.2.x while mine is/was 9.10.32.x)

And the bits are moving ;)
[Connected Car] fuzzyy@:
Hello markkpatel,

nice work! But i have a little problem. The app is correct installed now.

If i open the offroad page then there comes the "DRM popup".

How can i disabled the popup?

Which file must be manipulated for this?

My second problem is the cargo cam function, i does not work.

thx

fuzzyy@
[Connected Car] markkpatel:
Run command os.execute("touch /fs/etfs/disableDRM"). You only need to do this once.

This creates an empty file at /fs/etfs/disableDRM

Or try deleting file /fs/mmc1/kona/preload/xlets/DRM.jar

Make a copy first, I have no idea if this will work. But it is what I would do.

Thanks,

Mark
[Connected Car] Tooltime:
Hello,

I tried Leighm0's scripts on my Challenger 2015 with Uconnect 8.4 RA4 (16.16.13). Thank you very much for all the information and the files!

I copied over the patched media.sh and the booter.lua script and I can now open the Wifi App and start the access point, which makes me believe the patched media.sh and booter.lua is executed during startup.

However I am not able to connect via SSH to the Uconnect device (192.168.5.1).

Is the ssh port maybe blocked via WIFI or something?

Anyone a idea?
[Connected Car] fuzzyy@:
Hello,

i use the booter.lua. There are the following commands.

#!/usr/bin/lua
local pps = require("pps")
local os = os
local clock = "com.harman.service.Clock"
local busName = "com.harman.service.diagserv"
local NAV = "com.harman.service.Navigation"
local gps = "com.harman.service.NDR"
local framService = "com.harman.service.PersistentKeyValue"
local vehStat = "com.harman.service.VehicleStatus"
local VideoManager = "com.harman.service.VideoManager"
local Sat = "com.harman.service.XMApp"
local XMApp = "com.harman.service.XMApp"
local ppsVehCfg = assert(pps.open("/pps/can/vehcfg", "rwc"))
local ppsVehStat = assert(pps.open("/pps/can/vehstat", "rwc"))
local variantProduct = os.getenv("VARIANT_PRODUCT")
local present = 1
local notPresent = 0

--ppsVehCfg:write("DAB_PRSNT", present)
ppsVehCfg:write("VC_CHMCM_Prsnt", present)
ppsVehCfg:write("SVC_SK_PRSNT", present)
ppsVehCfg:write("CHMCM_Prsnt", present)
ppsVehCfg:write("VC_OffRoadPg", present)
ppsVehCfg:write("VC_PE_Prsnt", present)
ppsVehCfg:write("VC_PP_Prsnt", present)
ppsVehCfg:write("VC_STP_PRSNT", present)
--ppsVehCfg:write("VC_SRT_PRSNT", present)
--ppsVehCfg:write("Sdars_Presence", present)
--ppsVehCfg:write("SDAR_TRL_LNK_PRSNT", present)

os.execute("touch /fs/etfs/DISABLE_SPEED_LOCKOUT")
os.execute("touch /fs/etfs/NAV_SECRETS")
os.execute("touch /fs/etfs/enableEngMenu")
os.execute("touch /fs/etfs/enableDlrMenu")
os.execute("touch /fs/etfs/enableDealerMenu")
[COLOR="Red"]os.execute("touch /fs/etfs/disableDRM")[/COLOR]
os.execute("touch /fs/etfs/disable_DRM")
os.execute("touch /fs/etfs/disable_SpeedLockout")
os.execute("touch /fs/etfs/useWLAN4QXDM")
os.execute("touch /tmp/networkingpossible")
os.execute("touch /tmp/ECELL_GPS_DISABLED")

os.execute("/fs/mmc0/app/bin/sshd")

Nevertheless, I get the DRM message

Any other idea?

thx

---------- Post added at 05:05 PM ---------- Previous post was at 04:57 PM ----------

Hello,

you have these commands in the media.sh file?

echo "root:8CNGLiYvSaCbg:::99999:7:::" > /tmp/shadow
ln -sP /tmp/shadow /etc/shadow

cp -f /fs/mmc0/app/bin/sshd_config /tmp
ln -sP /tmp/sshd_config /etc/ssh/sshd_config

qon -d lua -s -b /fs/mmc0/app/bin/booter.lua

the sshd_config is copied?

if all that is accomplished, it should work.

PS. I can connect my phone via ssh, but my pc does not work. Maybe this hint will help you

There are no ports blocked
[Connected Car] Tooltime:
Thank you fuzzyy@,

that was a good hint, I checked everything again and realised I missed to copy the sshd_config intially to /fs/mmc0/app/bin/. After I copied it, I still couldn't connect with my phone via SSH, but with my computer.

The weird thing is, it takes ages, it took me approx 5 min till I was able to enter the password and then another 5 min till I received the prompt again. Then I was connected, but the whole ssh session was extremly slow and freezed for approx 1 min every now and then. I am not sure what is going on there. :confused:
[Connected Car] fuzzyy@:
After booting the uconnect wait for 5 - 10 minutes until the system is fully powered up and then start the wifi and log in.

That should work better
[Connected Car] markkpatel:
This line is in the screen that has the Cargo_Camera button:

Peripheral.vehSettings.addEventListner(VehSettingsEvent.CARGO_CAMERA, this.onCargoCamera, false, 0, true)

ppsVehCfg:write("VC_CHMCM_Prsnt", present) just writes data to a file.

As far as I can tell it should not work.

I don't know why it seems to work for some people.

The screen with the Cargo_Camera button is waiting for an event called "VehSettingsEvent.CARGO_CAMERA" to be received (at which time it will redo the cargo_camera code).

After the ppsVehCfg:write command you need to have another command that tells the event listener to start the "VehSettingsEvent.CARGO_CAMERA" event.

This is what events are for.

We need to find the method that creates the event. I would like to know what methods are in class "Peripheral.vehSettings".

Does anyone know how to write lua code that will output a list of all methods in a class to an output file?
[Connected Car] Leighm0:
Yeah just went through my modified files, my modified MainSupplement.swf forces True for Cargo Camera in a bunch of places.
[Connected Car] Tooltime:
I am looking into updating the NaviServer with a patched one so I can use the maps from the Android version and "migrate" from a US unit to a EU unit. My unit is on 16.16.13 (MY15 RA4) and as I understood the patched NaviServer files from Leighm0 is from a Unit running 16.13.13. Could one provide the original NaviServer file from a 16.13.13 unit, so I can compare it with the patched one to get a easier start with patching my NaviServer?

Also when you use iGo from a Android device to extract the maps and lyc file, which iGo have you guys bought? I can see iGO Navigation and iGO PAL (where the logo says iGO primo nextgen).

Just wondering which one is the correct one. :)

EDIT: I think iGO PAL is using latest HERE maps from 2018 Q1 while iGO Navigation uses 2016 Q4 maps (tomtom or Navteq?). Does one know if HERE maps can be used? The file extentions (fbl, fba, 3dl, 3dc seems to be the same as the uconnect uses).
[Connected Car] devmihkel:
Yeah, as said Naviserver2 binary works fine on MY16 and 16.33.29 (though it is old VERSION=9.10.2.x), but the opposite is also true so 17.x "backported" (VERSION=9.10.32.x) patched binary rocks as good on 16.33.29 of mine. Naviserver2 appears to originate from 14.x, attached is the extracted original for your amusement (can be found inside ifs-cmc.bin image on <17.x series ISOs).

I would search for something like "Unable to activate the product with you" when decompiling ;)

HERE maps.

Have fun.
[Connected Car] Tooltime:
Hello devmihkel,

thank you very much! I was thinking also it is inside of ifs-cmc.bin, but was not sure how to mount it on my computer? Do I have to use a QNX VM to mount the ifs-cmc.bin?

Thank you in advance.

Best Regards

Tooltime
[Connected Car] fuzzyy@:
Hello Leighm0,

the Cargo Camera works. thx

but I still have the DRM popup in the OffRoadpage and WIFI.

With the wifi button I can click it off and I come to the wifi settings, all ok. But that does not work on the offroad pages.

For information, I have copied all hacked data (16.13.13) from booter.lua to main.swf. in my uconnect.

But I do not get the DRM message away.

Do you have another idea?

greetings
[Connected Car] devmihkel:
".UPD" ISO-s on MY16 are still the same (tested on 16.33.29 version), where /etc/manifest.lua lends itself to execute whatever upon inserting USB (right before the update prompt gets displayed). Just hexedit swdl.upd and locate nearby strings, say something around "hd_update" block and replace that whole block by some "os.execute" lines to your heart desires. Mount installer.iso within UPD afterwards to check the outcome if feel like it. I find launching some "sh /fs/usb0/script.sh" off the same USB stick handy :cowboy:
[Connected Car] shmigga:
Has anyone considered trying to get Android Auto loaded into the pre 2017 U connect units?
[Connected Car] Stern.m33:
Hey you all I have been going over every page of this forum looks very very interesting and a lot to look forward to!!!

[MENTION=455363]Leighm0[/MENTION] thanks for all this hard work. 1 Question after you posted your modified iso. Is there a simple way to put the map files onto the unit? I read the first way, but now with your iso is it as simple as putting the content folder and lyc files onto the USB with your iso?
[Connected Car] devmihkel:
IOActive paragraph is confusing there, but the point remains valid - you can dump some with "dumpifs" (doesn't matter if in VM or using e.g. Linux binary available), but some interesting stuff remains un-dumped "since it is a non-standard IFS image. A more thorough examination of the IFS can be done on a working head unit that has been jailbroken". That's because you need memifs2 for this and that binary is available ARM-only (QNX VM is x86).

ifs-cmc.bin is combined image with partitions. I have found easiest just to search for the "hbcifs" marker and cut and slice the partitions. The resulting junks are mountable by memifs2 on the unit, so can be extracted like this.
[Connected Car] Stern.m33:
Anyone got a hacked modified upd for my16 please upload! Much appreciated
[Connected Car] HanJ67:
upd iso files

Hi Devmihkel. I was pointed to this thread by one of my android app users to activate the SRT pages. What you write here is actually very interesting. Would you be so kind to explain a bit in more detail. What I understand that etc/manifest.lua always runs when USB is inserted. But more interested is how insert os.execute commands or a name of script on usb that can run. On my setup I got stock with the DRM issue but I never found a way to insert the file to get it working again after I stupidly updated to the latest firmware of my radio. The point were hd_update is located was easy to find.....

Thanks in advance... han
[Connected Car] devmihkel:
Well yes, to ensure manifest.lua does not error out before getting to your, say

os.execute("sh /fs/usb0/script.sh")

it makes sense to remove the "," character just above hd_update block and replace it with a newline (CR+LF) and to introduce final closing bracket there. Then you are ready to fire your own line, once again terminated with newline characters. And to make things look nice you could space out some of what's left over, but that really shouldn't matter, as who cares for the error messages appearing afterwards ;) As already said, it might be useful to mount this modified nstaller.iso within UPD afterwards to check the outcome of your great handiwork :cool:

For testing script.sh on USB might include something like "echo foo > /fs/usb0/123" and remember to "mount -uw /fs/mmc0/" in case you plan to write/edit something onto /fs/mmc0...
[Connected Car] HanJ67:
Thanks for the info. The first attempts however fails. As you said you might receive some errors but I got an error on a "hash" mismatch between header and file. I kept the file exactly as long as the original. What is not clear is what exactly to edit. I edited the full UPD file. As you know this file is a composition of installer.iso primary.iso and secondary.iso. The changes are made in the part that matches installer.iso. I did this since the radio does nothing with a iso file, at least nothing with a "swdl.iso". Could be I did something wring in the upd so here a screenshot. See the changes above hd_update with LF/CR

In this upd file HD_update is found twice but none of the blocks has a "," above it as you mentioned. I also checked an older iso and that had indeed the "," . The USB stick has the swdl.upd the script.sh and an empty diableDRM file. The version is 17.09.07 EU... If you see something wrong then please let me know....

thanks, Han :good:
[Connected Car] devmihkel:
For good or for bad NOT everything appears correct, except the running 17.x version... As of now neither the "commercial jailbreak" supports new versions (well yes they were using exactly the same file to start with ;) Also 16.51.x or newer appears to be no go: uconnect-8-4-8-4an-update

EDIT: haven't got 17.09.07 to try, but on 17.11.07 manifest.lua has changed and the last block/ search keyword is "ota_update" instead. Otherwise all the same, image valid after the edit and script.sh gets fired - at least on 16.33.29 that is ;) [MENTION=9239751]HanJ67[/MENTION] Did you actually try to mount installer.iso after the edit and checked /etc/manifest.lua for the end result before?
[Connected Car] HanJ67:
Was already afraid this this might happen...:rolleyes: Thanks for your good help .... Will do some hash calculations but realistic speaking it stops here...

Han
[Connected Car] jamseyo:
So any chance of android ;)
[Connected Car] HanJ67:
Hopefully I can try tonight.....Uh no, I did not edit the installer ISO separately after extraction and then mount it. I first extracted and did a hex view and compared this with the UPD file. There was no additional compression or so. Then I edited the UPD file as in the screenshot. This mostly to not change more to the upd as needed. After changing I should extract and then mount??? or should I extract the installer, then edit, and compile again to the UPP to avoid Hash error. I will try both....but again thanks for the great work...:good:

Searched for "ota_update" but that is a no go for the European version, meaning the hex file does not contain the option and so for the radio. Mounted the installer and searched for other options but most is encrypted but need an entry point before isoChk.lua is executed I guess. Just wondering what would happen if I use an older version and put that on the USB stick. ?? Would this also execute the script or would it error out because of older version. Or may be 17.11.07 as you tried since for the EU version there is no older UPD variant available. Here you can find also the eu version. I use this server also to download the 17.11.07 version. Just to try. http://jeepgarage.org/f239/sox-s-dd-srt-202802.html
[Connected Car] devmihkel:
No need to edit the extracted ISO, just directly in UPD file as you did. As UPD itself is nothing more than an ISO, which contains 3 separate ISO files within. On Linux you can "loop mount" all of this directly just by mounting your edited UPD iso first and next mount installer.iso from there. This way you can immediately check the result of your edit, so no need for trial and error before you are sure everything appears correct in UPD ;)
[Connected Car] Tajadela:
you can do this with an ELM327 interface, and Multiecuscan or AlfaOBD software...
[Connected Car] Tajadela:
Hi,

how can I to decode the root password??

thanks

"Second i changed the root password at offset 0x5dd34b4 to 8CNGLiYvSaCbg which is "root""