[Connected Car] Leighm0:
Hi, sorry I have not read this forum in a long time..

1. No - 1 USB, 1 ISO, all your hacks on the same USB stick..

2. No. Just run the hacked ISO, it'll authenticate and you say Yes to upgrade to old version, it reboots and does the hack, and then finishes before applying patch, then prompts to reboot.

3. Again No.. 1 usb, 1 iso.. no switching or changing - they have mechanism in place to check for usb switching/iso changes, so it fails.

4. You must modify the ISO itself, using HexEditor and/or a C++ Application. (I used both) You CANNOT modify files and then inject them back into the ISO file, it breaks the SSL Hash in the header. YES even with the "S" bypasser, your ISO still NEEDS to pass the MD5 Hash Checking of the car, otherwise "Invalid ISO - Not authenticated" is displayed.

5. Easy squeezy, its part of the LUA script which is modified in Hexeditor/C++.

You do NOT need an EU or location sepcific ISO - I used the North American VP4/RA4 ISOs (as they were smallest) and my car unit is a ROW VP3/RA3 (Australia)... all the mods done on the ISO bypass these checks for location, unit model, etc.

To get you all started, here are 2 links to my modified ISOs, they work in ANY 8.4" uConnect (NA, EU, ROW) as long as your firmware is not updated to the point where it requires the .UPD file types.. so before v16.33.xx on most uconnects I believe...

MY14-15 Cars (these units were almost the same, so this ISO works on both):

https://mega.nz/#!11NmibxS!9bbErJW_ggGNDuOzOeLoKiPhjQVhQHuK9QqNXmEhVsc

MY16 Cars (these units changed from the MY14/15 so require a different ISO due to their Partition layout changes):

https://mega.nz/#!l9klBARZ!fxY-mLB8ppokfqpHgg9w6cQmSHa1pVjZIin-Ms7wHYk

MY17+ - Sorry you guys are **** out of luck.. you started with higher firmwares I believe which dont allow these old ISOs to run... because they simply werent available for your unit!

What was applied to these ISOs:

1. "S" flag added to Hex Position 0x80, this is to allow for the LUA scripts which are not encrpyted in the ISO to be modified AFTER 2048 byte marker.. it will not let you just inject any old files into the ISO, they will fail authentication!

2. Modified the "system_module_check.lua" to ignore the Market (NA/EU/ROW) and Product (VP3/VP4/RA3/RA4 etc) types, and just run anyway.

3. Modified the "system_module_check.lua" to run a LUA Script on your USB stick called "script.lua" in the root directory, after done it will STOP the update and ask you to remove USB stick to reboot.

I have info on doing this yourself, using hexeditor, c++ program on a linux OS, if anyone is interested.

Example "script.lua" here:

#!/usr/bin/lua
local os = os
-- upload modified files
os.execute("cp -f /fs/usb0/modified/media.sh /fs/mmc0/app/bin")
os.execute("cp -f /fs/usb0/modified/booter.lua /fs/mmc0/app/bin")
os.execute("cp -f /fs/usb0/modified/sshd_config /fs/mmc0/app/bin")
os.execute("cp -f /fs/usb0/modified/NaviServer2 /fs/mmc0/app/bin")
os.execute("cp -f /fs/usb0/modified/nav.sh /fs/mmc0/app/bin")
os.execute("cp -f /fs/usb0/modified/navRestart.sh /fs/mmc0/app/bin")
os.execute("chmod 755 /fs/mmc0/app/bin/media.sh")
os.execute("chmod 755 /fs/mmc0/app/bin/booter.lua")
os.execute("chmod 755 /fs/mmc0/app/bin/NaviServer2")
os.execute("chmod 755 /fs/mmc0/app/bin/nav.sh")
os.execute("chmod 755 /fs/mmc0/app/bin/navRestart.sh")
-- end uploads
os.execute("mount -ur /fs/mmc0/")
os.execute(mountpath.."/usr/share/scripts/mmc.sh stop")
-- script done

Explained what I modified in the above files...

1. media.sh - Runs the booter.lua script on bootup, also does a bit of trickery with the /etc/shadow file for root password change and the /etc/ssh/sshd_config ;)

2. booter.lua - commands on bootup everytime, this runs from the modified "media.sh". I get it to disable speedlockout, enable engineering menu, disable DRM, turn on SSHd, enable CargoCam, SRT Pages, etc.

3. sshd_config - modified to PermitRootLogin yes, etc.. used by media.sh..

4. NaviServer2 - modified to accept ANY valid IGO license file, so I could inject the latest 2016/2017 AU maps :)

5. nav.sh - Simply modified to launch the modded NaviServer2 instead of original. Also get this script to attempt to run a LUA or Shell script from the USB drive (incase I want to quickly run something on startup!)

6. navRestart.sh - Again same as above, but incase the Nav is told to restart (not sure if this occurs.. but better to make sure it loads the modded one after it restarts!)

There ya have it.. and remember.. do so at your own risk, not held responsible for your **** ups, etc!

If you liked my work and wanna kick something my way... feel free to donate to my Bitcoin or Monero wallet, tho I don't expect anything.

BTC: 125YwAX5bCXDGN9M3JxnxGbxFEpTzjwnfP

XMR: 41yHnGy2SFXXSEUc5L1GkE8UasgPxVYaLVAakkMJpRpvgtoTbibSzBA2fvjmBZD4RELib2qVNHMkzLZRw3WTTaHXMeSPpjc

---------- Post added at 11:38 AM ---------- Previous post was at 11:16 AM ----------

Sorry.. not a coder myself, but this is what got it done for me.. there is probably some local declares here that are not even needed, but i kept them for safe measure..lol

#!/usr/bin/lua
local pps = require("pps")
local os = os
local clock = "com.harman.service.Clock"
local busName = "com.harman.service.diagserv"
local NAV = "com.harman.service.Navigation"
local gps = "com.harman.service.NDR"
local framService = "com.harman.service.PersistentKeyValue"
local vehStat = "com.harman.service.VehicleStatus"
local VideoManager = "com.harman.service.VideoManager"
local Sat = "com.harman.service.XMApp"
local XMApp = "com.harman.service.XMApp"
local ppsVehCfg = assert(pps.open("/pps/can/vehcfg", "rwc"))
local ppsVehStat = assert(pps.open("/pps/can/vehstat", "rwc"))
local variantProduct = os.getenv("VARIANT_PRODUCT")
local present = 1
local notPresent = 0

-- Enable DAB radio (requires antenna), works in my vehicle - just had to hook up a DAB antenna to the unit
ppsVehCfg:write("DAB_PRSNT", present)

-- Enable Cargo Cam (Button is in Comfort page)
ppsVehCfg:write("CHMCM_Prsnt", present)
ppsVehCfg:write("VC_CHMCM_Prsnt", present)

-- Enable Offroad Pages Xlet (not in EVIC)
ppsVehCfg:write("VC_OffRoadPg", present)

-- Enable SRT/Performance Pages Xlet (not in EVIC)
ppsVehCfg:write("VC_PP_Prsnt", present)
ppsVehCfg:write("VC_SRT_PRSNT", present)

-- Enable SatRadio (doesnt work on my vehicle)
ppsVehCfg:write("Sdars_Presence", present)
ppsVehCfg:write("SDAR_TRL_LNK_PRSNT", present)

-- Unknown what these are, added for testing purposes..
ppsVehCfg:write("SVC_SK_PRSNT", present)
ppsVehCfg:write("VC_PE_Prsnt", present)
ppsVehCfg:write("VC_STP_PRSNT", present)

To get a list of the "VehCfg" codes, you can download the file "/pps/can/vehcfg" from the radio while it is running using a boot script..