[Windows Mobile Development and Hacking General] seadiel:
Crazy you posted this as I been working on this for the last few weeks after that last forum died out.

You stated everything I figured out as well. I have thoroughly disassembled all the update files and found some interesting clues/ideas on a way in through the software side.

For the hardware side I have a good idea how it all works. You can use this to edit as built data w w w ucdsys.ru

The APIM as built data is programmed to the hardware and will tell the software what is enabled and what is not (Nav, backup cam) If you know the Hex values for the as built data and use a third party programming tool you can enable Nav/backup camera through the CAN. There is some more steps for the Nav going this route. You can get the ABD from ford here w w w motorcraftservice.com/AsBuilt and compare a similar year/model car with NAV/backup camera and one without to figure out the hex values.

What I have found out on the software side of things:

myfordtouch runs Windows CE/EDB databases via some sqllite commands then what we all see on the screen is flash (.swf). The update towards the end when it puts the .swf files in does a integrityfilescheck() which verifies the SHA256 hash on these .swf I suspect only. Nothing we can do on the SHA256 check.

But based on what I was able to dissemble from the update files on SYNCGen2_4.32.14122 file versions. The first thing it runs is the 14D546-EE.cab which saves an XML file on the thumb drive this will list your vin #, part #'s, processes running, space on TFAT,RAM,ROM. ect ect. This one is interesting to note the running .exe’s

Before the target images are applied, it appears to save “Registry settings” 14D546-AKB talks about gathering current language and then

“SOFTWARE\Ford\DataManager\gns\system”

“POPUP” NavUnlocked regkey = ‘%d’”

NavUnlocked

SOFTWARE\Ford\DataManager\gns\ApplicationSettings

Near the end of the update for the image files 14D546-AGB it has:

“SOFTWARE\Ford\DataManager\gns\system”

NavUnlocked

SOFTWARE\Ford\DataManager\gns\ApplicationSettings

“%S() Success restoring Nav unlock registry values.

LicenseCount

DPS indicates Navigation has not been unlocked! Exit.

I have created a program for Windows CE to retrieve the registry info to a text file on the USB drive. I was able to create the CAB and run the CAB, but after about 10 seconds it errors out with “Invalid or Unsigned File” my cab is unsigned I figured it wasn’t going to be this easy. Looking at the update files the cab is signed by “Ford Motor Company Internal SYNCGEN2 Issuing CA” and issued to: “Sync Dynamic Code Signing Gen2 A4” inside the cab the .999 file that does all the work is signed by “Microsoft Test Software Publish Certificate” The SYNCGGEN2 is a SHA1 signature hash algorithm. The Microsoft one uses a MD5 hash algorithm and appears to be some random certificate built into the platform builder that says do not use for publishing. I am working on a few methods to get around the signed file. I may try loading the code into a random .jpg or image file and upload it to the background area and in theory once uploaded and clicked on should run the code. Simple Trojan horse.

Code in the Appconsole.swf as noted in the prior thread that determines if NAV should be displayed in the right corner of the screen or if Information should be.

SyncUtilLin797staticfunctionIsNavSystemInstalled()

staticfunctionIsNavSystemInstalled()

{

var_loc1_=false;

if(SyncConst.UseNavOverride)

{

SyncBaseClass.swarning(SyncUtil.sCN,"GetNavSystemStatus:eek:verriding\'IsNavInstalled\'flagtotrue,sinceSyncConst.UseNavOverrideisset.");

_loc1_=true;

}

elseif(Plugins.DataManager)

{

var_loc4_=SyncUtil.GetDMNumber("InboundDiag.NavAppEnabled",1);

var_loc2_=SyncUtil.GetDMNumber("ApplicationSettings.NavUnlocked",0);

var_loc3_=SyncUtil.GetDMNumber("Provisioning.NavInstalled",0);

_loc1_=Boolean(_loc4_==1&&_loc2_==1&&_loc3_==1);

}

else

{

_loc1_=false;

}

SyncConst.IsNavInstalled=_loc1_;

return_loc1_;

}