yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] kamilien:
Dealer price is €160 Euro for F7. Hope we can find one soon.

As for Mirrorlink, I think we need a Windows Embedded Compact developer . :(

EasyConnected app can be run on most of the WinCE devices from SD card reader for VW, Skoda, Seat etc. App has adb drivers for android devices and executable file for Windows. Somehow they have implemented it to MFT...
[Windows Mobile Development and Hacking General] OuHiroshi:
Here's some more info about Easyconnect/mirrorlink on the Sync 2:

https://vk.com/ford_option_chip_ford

https://www.drive2.com/l/472938160209264681/
[Windows Mobile Development and Hacking General] COMpulse:
I think what we need is someone who knows SWF / ActionScript enough to modify the NaviPatch PNG to execute a file on the USB drive.
[Windows Mobile Development and Hacking General] haygun:
Did my friend get the F7 version? Is there any source or link on the ? If you have a send, will you share with us. Thank you.
[Windows Mobile Development and Hacking General] ric84:
​

I really would like to have this Mods to make Sync 2 great again. Is there any for Downloads, looks like they want to get paid for the Hack.
[Windows Mobile Development and Hacking General] orlandson:
Me too. Is that available for purchase?
[Windows Mobile Development and Hacking General] kamilien:
They want 6000 rubles (about $100 I guess) for just Mirrorlink, If I understand their message correctly.
[Windows Mobile Development and Hacking General] flex1911:
Warez/piracy is strongly forbidden on XDA:

Warez links have been removed.
[Windows Mobile Development and Hacking General] COMpulse:
I would throw down $100 to get this working. Who do I talk to?
[Windows Mobile Development and Hacking General] rioachim:
https://www.drive2.com/l/468892507174862924/
[Windows Mobile Development and Hacking General] kamilien:
You can talk to boom666 in drive2.ru. rioachim has already shared the link.

Swapping to the sync 3 with a little more spend is a better option, imao.
[Windows Mobile Development and Hacking General] SchimiEX:
i´m interested in sync2 mirrorlink, too :)
[Windows Mobile Development and Hacking General] Mojaldo:
I bought the software from the Russian guy mentioned above for $85.
[Windows Mobile Development and Hacking General] orlandson:
Hi [MENTION=6913156]Mojaldo[/MENTION]. How it works? It's a software you have to install in MFT and smartphone?
[Windows Mobile Development and Hacking General] SchimiEX:
yes, give us more info :)

how you contact him? The Russian Website is a little bit "strange" :)
[Windows Mobile Development and Hacking General] Mojaldo:
I tooka chance and it paid off. Will send contact details via PM. Not sure if posting rules allow me to post email addresses on here

---------- Post added at 02:07 PM ---------- Previous post was at 01:58 PM ----------

It's a software that installs the mirrorlink app on your MFT. This allows you to connect your phone via usb. You'll be directed to download "easycon" app onto your phone. Then hey presto, your phone screen is mirrored onto your MFT. I use it to watch live F1 and English Premier League. I also use the google maps and YouTube apps.
[Windows Mobile Development and Hacking General] Mojaldo:
Here's a shot of me watching the spurs/ Cardiff game right now
[Windows Mobile Development and Hacking General] SchimiEX:
i contact him… hope it works with Android 8 (9) and/or Win 10 Mobile :D
[Windows Mobile Development and Hacking General] Otisrhw:
How did you get mirrorlink on sync2?

---------- Post added at 03:57 AM ---------- Previous post was at 03:53 AM ----------

How do you swap to sync 3 for little more than 100.00

Can you swap apim or screen also?
[Windows Mobile Development and Hacking General] Mojaldo:
I use S9+ and S7 edge. Good luck.
[Windows Mobile Development and Hacking General] ric84:
Hey, nice to see it work.

Does the Display of the Phone always need to be active? For example when i scroll around in Spotify and so on.

Is the sound also by USB or still bluetooth?

Thanks in advance for your reply :)
[Windows Mobile Development and Hacking General] Mojaldo:
Unfortunately, phone screen must remain on and Volume is via Bluetooth. Reverse camera still works and steering wheel fast forward/skip buttons work in apps like YouTube and Samsung music
[Windows Mobile Development and Hacking General] wayneace8888:
Can't you just share the files, save everyone else paying for it? I know I'm a cheeky sod ??
[Windows Mobile Development and Hacking General] SchimiEX:
ok, I got it.... it works with the Xiaomi A1 (Oreo 8.1) but not with the Nokia 1 (Android Go 8.1)….

the App, that i had to install is 50% Chinese and 50% English :D but it works... I hope the Chinese don´t had access to my device :D
[Windows Mobile Development and Hacking General] wayneace8888:
What's the app please?
[Windows Mobile Development and Hacking General] SchimiEX:
EasyConnected…..

the Sync2 Install, looks like it's connected to the serial... so it only work on the specific sync2 device
[Windows Mobile Development and Hacking General] wayneace8888:
I already have easyconnected, but it's not working what do I have to install on the actual car head unit?
[Windows Mobile Development and Hacking General] SchimiEX:
It looks like easyconnected for wince...
[Windows Mobile Development and Hacking General] wayneace8888:
I have that too, maybe I need to install it via USB instead of trying on my phone haha
[Windows Mobile Development and Hacking General] wayneace8888:
OK so used the app and from the rubbish translating from Chinese I'm reading it as I gotta write tlit onto the satnav card, I've done that but it's still not working.... Any ideas guys?
[Windows Mobile Development and Hacking General] orlandson:
Can you please share some links?
[Windows Mobile Development and Hacking General] SchimiEX:
here you can see the install instructions... I think it is easier to understand :D

https://yadi.sk/i/xXhgZiuo3ZTuz6
[Windows Mobile Development and Hacking General] kamarush:
Did anybody managed to decompress or mount the sec file?
[Windows Mobile Development and Hacking General] wayneace8888:
No, can't work out how to decompres any of it
[Windows Mobile Development and Hacking General] azitoshi:
I have found in web this zip is this easyconnect ? can i install it somehow to my sync2 ? :eek:
[Windows Mobile Development and Hacking General] orlandson:
I think some files are missing.

Look at install instructions:

https://yadi.sk/i/xXhgZiuo3ZTuz6
[Windows Mobile Development and Hacking General] azitoshi:
Yes i think this most important is missing *.jpg which is used as an exploit :(..... and this install.bin file must be easyconnect for wince i suppose. Wonder if somebody finally make it public :)....
[Windows Mobile Development and Hacking General] wayneace8888:
You have 3 files missing in your zip you found, should have..

Installer.jpg

Pack_install.bin

Update.bin

Update installer.dll

I have the zip with all file but won't install as its made to be used on another serial number Sync2.
[Windows Mobile Development and Hacking General] COMpulse:
If you want to send to me I may be able to decompile and modify sn.
[Windows Mobile Development and Hacking General] Pepsi1:
I've sent you a PM with the download link for all the files
[Windows Mobile Development and Hacking General] azitoshi:
Great news :)
[Windows Mobile Development and Hacking General] COMpulse:
Just like the NaviPatch PNG, the JPG is a compressed SWF file.

Step 1 is to take the .JPG and run it through FLASM -x to decompress it to SWF.

Then it can be opened in FFdec (Flash decompiler) for modification.

The idea is to remove the SN check and save the new SWF. Rename to JPG or whatever image extension and try loading it in the car.

However, the SWF code has been run through an obfuscator, so it is hard to read. So I invite anyone to muck with it as well. There isn't much code to look at, so someone with some initiative and a vehicle to test might be able to finish the job here.

I totaled my Taurus last month, so I don't have a vehicle to test in. :(
[Windows Mobile Development and Hacking General] orlandson:
I can try.
[Windows Mobile Development and Hacking General] BeciMester:
I wouldn't mind having a look if someone posted the files. :)
[Windows Mobile Development and Hacking General] orlandson:
I've sent you a PM.
[Windows Mobile Development and Hacking General] azitoshi:
ready to help, i can try it out in my focus 2015 ;D
[Windows Mobile Development and Hacking General] COMpulse:
pepsi1, I don't want to share your files with anyone else unless you say it's okay.

I've modified the JPG. I only noticed one condition (IF/THEN statement) in the code. I modified the code to always execute what's in the IF/THEN condition. I'm hoping the IF/THEN is the SN check.

Please let me know if it's okay to share my tests with the forum. Having multiple testers will be helpful.
[Windows Mobile Development and Hacking General] Pepsi1:
It's okay to share the files,they are not mine.plase post here the files so the users can test them. I'll post later the serial nr from the car that received those files so we can see what to change.

Thanks
[Windows Mobile Development and Hacking General] COMpulse:
Here is the complete ZIP, with a modified JPG in it.

https://mega.nz/#!pFhg1IBD!gkU1y3tDS9fhVZpC0QI70mzFEXPNQuSXVULF_X0Cwnc

Anyone testing should know that while I don't think any major harm can come from this, I'm modifying code that I can't read, so there could be some risk.

Please report feedback. For some reason, I decided that this is my thing for today.
[Windows Mobile Development and Hacking General] wayneace8888:
I'll give this a try, going by the file name I'm assuming this is the one to install navitel navigator and not the mirrorlink one
[Windows Mobile Development and Hacking General] COMpulse:
Honestly, you probably know more about this than I do. I just saw something this morning that I thought I could hack apart and decided to give it a try.

I assume the contents need to be unzipped to a USB drive (not sure on folder structure so maybe check the install PDF document linked earlier in the thread), and then the Installer.jpg loaded just like the NaviPatch file.
[Windows Mobile Development and Hacking General] Pepsi1:
Yea,the files are for navitel as I can tell from the .zip filename.
[Windows Mobile Development and Hacking General] azitoshi:
i will test this file today, but iam wondering what is this doing adding navitel to apps or easyconnect ? this bin file i have posted early should be easyconnect, maybe to install easyconnect we need only to swap install.bin files.
[Windows Mobile Development and Hacking General] COMpulse:
I don't think my changes applied to the file I uploaded. I will check and upload a new one.

---------- Post added at 02:43 PM ---------- Previous post was at 02:33 PM ----------

From the instructions, it appears that the files should be in

USB\SyncExtPack

I've uploaded a new version. I confirmed the first one did not apply my changes. And confirmed this one did apply my changes.

https://mega.nz/#!EAwkiSoD!r5wDXqy3hc_uLHNdySNtuYSo7xqpoXmbwaE0tznjPIQ
[Windows Mobile Development and Hacking General] orlandson:
Tried your mod2, I think it does nothing, like the unmodified version. I selected the installerMOD2 JPG but got only a normal message from wallpaper change.
[Windows Mobile Development and Hacking General] azitoshi:
yes same here this jpg just added to the wallpapers list according to the instruction it should reboot sync2. i have installermod2.jpg on the list now but i am a bit affraid to click on it maybe it will start the code ? https://ibb.co/d4QmNf
[Windows Mobile Development and Hacking General] COMpulse:
Do not change your wallpaper. Add the Wallpaper to the system, and then in the Wallpaper preview, first try waiting a minute or two. If nothing happens, I would try clicking one of the blue boxes to see if they do anything, since I have only seen instructions for the MirrorLink install and not seen any instructions for the Navitel install.

If I had the complete MirrorLink install ZIP I could compare the two JPGs, and also try modding the MirrorLink installer.JPG
[Windows Mobile Development and Hacking General] azitoshi:
which blue boxes u mean ?

---------- Post added at 08:35 PM ---------- Previous post was at 08:27 PM ----------

and if you are looking in the code for serial numbers (i couldnt find nothing similar) i send you link to picture to show you how this serial numbers looks like https://ibb.co/invsCf
[Windows Mobile Development and Hacking General] COMpulse:
When you preview the JPG, I believe there are two blue squares in the preview image. I'm not sure if they are buttons or not. Try clicking them.

As for editing the code, I am not looking for a serial number. The code is all obfuscated so there are no obvious strings of text at all. I am trying to simply remove the SN check completely.

Edit2: I might also try renaming or copying "pack_install.bin" to "install.bin" just to see if anything changes.
[Windows Mobile Development and Hacking General] orlandson:
I don't believe the click on blue boxes in preview image is efective.
[Windows Mobile Development and Hacking General] azitoshi:
Ok i have checked and that two blue boxes in preview are not buttons, there is also tex secureSWF :). What else can i do ?
[Windows Mobile Development and Hacking General] BeciMester:
I'm using FFdec v.11.2.0, in the Settings tab I ticked on 'Automatic Deobfuscation' and the code is readable - but I'm sure you found that already.

In the variable declarations at the beginning the numbers are letters, this is what the d() function decodes, but as a rule of thumb, divide the even numbers by 2 and the odd numbers by 3 and you get the char code. :)

The strings in the order of appearance are:

Plugins
DataManager
getValue
getResult
OutboundDIDs.APIMSerial
FileBrowser
FileBrowserPlugin
FBCopyFile
NativeApplet
UpdateInstaller
/USB Disk/SyncExtPack/UpdateInstaller.dll
windows/UpdateInstaller.dll
X______M (redacted, it's the 8 character APIM ID from the original filename)

It needs a bit more work but it's a start.
[Windows Mobile Development and Hacking General] COMpulse:
Awesome. Sounds like you're more familiar with this than I am. I didn't know the char decoding trick. And all of that info is helpful.

So, you could probably modify the APIM ID to match yours and try installing...?
[Windows Mobile Development and Hacking General] azitoshi:
I can try to enter my apim id there as i understand its linie with "var _locl 21_ = ....." , but i think i need unmodified installer.jpg :)

and i dont know how to save modified swf file to jpg :)
[Windows Mobile Development and Hacking General] COMpulse:
Once the JPG is decompressed to SWF, the bytes for the obfuscated APIM ID begin near offset 2314 thru 2353. And the chars are ordered last-to-first.

It looks like 4 bytes for the obfuscated char code, followed by 1 byte of x07. So in theory the file could be modified with a hex editor.

So, if someone gives me their APIM ID then I can try modifying the file directly and provide a new test.
[Windows Mobile Development and Hacking General] azitoshi:
Mine is XT2R28J8
[Windows Mobile Development and Hacking General] BeciMester:
OK we're halfway there. :)

[MENTION=3694909]COMpulse[/MENTION] is right on the money, although I went about it in a different way: I used FFdec to edit my APIM serial into the file and saved as SWF, then renamed it to JPG.

I followed the instructions in the Yandex PDF a few pages back, and the first part works fine: after tapping the JPG name in Sync, the unit reboots, the Sync logo comes up and it says something like 'Performing scheduled maintenance' with a progress bar at the bottom (there is no screenshot of this in the PDF), and eventually the normal home screen comes back up. However, when I rename the MirrorLink file to install.bin and re-insert the USB stick into the car, nothing happens. At the first part Sync reacted to the USB stick within seconds, but I waited more than 3 minutes at the second part and nothing.

Next I'm going to look at the install.bin to see if anything needs to be changed there too.
[Windows Mobile Development and Hacking General] BeciMester:
Here you go good sir, this should work for you. :)
[Windows Mobile Development and Hacking General] orlandson:
Do mine please.

Serial XTBCR3MR
[Windows Mobile Development and Hacking General] seadiel:
flsdiver,

Yea you just discovered what I discovered with the "APIM ID" but I think it is the ESN. I just changed a file to match my ESN and will try later today on my car and let you know. It may be possible you must install all the NAV files, put the unit into safe mode then run the 14F500-BE while in safe mode.

It could also require the ABD to be changed in addition to the file change/nav files installed.
[Windows Mobile Development and Hacking General] flsdiver:
APIM ID i posted was from MFT diagnostic screen for APIM...same as ESN on dump file i have from XML of what's installed on the truck. So we are talking the same thing. will use ESN for reference now.

Tried 3 cabs modified to my ESN, no luck. perhaps outa luck on NA vehicle. APIM ABD programmed to have NAV on as well. Will be interested to know your results.
[Windows Mobile Development and Hacking General] seadiel:
Yea I just tried and did not work. There is a lot of extra hex values after that ESN so I will study that info and compare to other 14F500-BE files.
[Windows Mobile Development and Hacking General] wystewart:
Very interesting thread, thank you for all your work so far, I am hoping it will help me with my project.

I would like to ask again (my previous request is buried a few threads back), how does one program the as-built of the APIM? My understanding is that it cannot be programmed with IDS; that that module is blocked by ford. I know that forscan recently added the ability to change as-built, but I haven't been able to figure out if it can change the APIM. I don't currently have hardware (yet) to try it on. So it would be very much appreciated if you could enlighten me on APIM as-built programming.

I am looking at retro-fitting an MFT with nav already programmed into a different vehicle than it came originally from. I think that the as-built will need to be changed to match the hardware configuration in the new vehicle.
[Windows Mobile Development and Hacking General] sheltonfilms:
Yes Forscan can do it. Certain models haven't shown the APIM in the configuration page but the team has been working with individuals to get all models working.

Which model car are you working on? Essentially you would load the ABD onto the new module and change the one HEX half byte (really changing a bit, but you have to enter a new half byte) for navigation (which one may depend on the model).

Also I would enable the change on the IPC and ACM to get 100% of navigation features (access to the navigation section in the IC, etc).
[Windows Mobile Development and Hacking General] wystewart:
Thanks so much for the reply.

Want to put it into a 2014 mustang. That vehicle is sync1, so it will involve re-wiring and also replacing the ACM amoung other challenges. The current ACM is not compatible with the sync2 configuration. The IPC has no features to display nav, so I'll have to exclude that part. I've just bought an MFT setup from a 2013 fusion, soon to come; it already has nav and rear camera enabled. First I'll set it up on the bench, I won't install directly to the car. I'll connect an ODB adapter and see what I can change from forscan. I got some canbus tools from another thread (https://www.scantool.net/forum/index.php?topic=6769.15) that I hope to use to record traffic from my car, then play it back to the bench setup.

I got a feeling the the APIM may need to be re-programmed, if I need to do that I have someone in mind that can certainly do it.
[Windows Mobile Development and Hacking General] rioachim:
wystewart, please don't hijack the thread, what you are asking (upgrade Sync1->Sync2) requires the help of a professional with IDS/OASIS access and is out of the topic of this discussion.
[Windows Mobile Development and Hacking General] COMpulse:
FORScan beta 04-12 added APIM AsBuilt for the Taurus. Mustang can't be far behind.

I'm just gonna mention, IDS/OASIS isn't out of reach or scope. I bought a $150 VCX Nano adapter that works with IDS. That's not much more than I spent on the OBD Link MX BT.

And as far as we know, we might need IDS to get nav working.

Lastly, this thread seems very focused on Nav. Should I create a new thread to focus more on AsBuilt in general (instrument cluster features, driver-assist, nav, etc)?
[Windows Mobile Development and Hacking General] wystewart:
Sorry, that was not my intention. I was merely answering the question on what vehicle I am working on (with a long winded response ...). I do not intend to discuss anything else sync1 related. My interest in this thread is solely on programming a sync2 MFT APIM to modify its feature set (as-built) and understanding better the cab file installation.

Thank you for the programming procedure for the APIM with IDS/VCM. Do you know if it is possible to program an APIM with IDS/VCM with the APIM alone on a bench setup (not in vehicle), or will IDS complain that it can't access the rest of the vehicle systems?
[Windows Mobile Development and Hacking General] lucasb8888:
I have access to IDS and under the module programming menu there is no APIM option. From what I read FORScan can but I have yet to verify as I do not have the ELM327 adapter yet. When IDS loads it seems to me that it is looking for the PCM. You can manually start a session which asks for PCM data. I haven't had much time with IDS so there probably more to it than what I have seen.
[Windows Mobile Development and Hacking General] flsdiver:
OK, comparing 2 binaries of BT4T-14F500-BE.CAB, only 2 differences are the ESN in the signature block and the actual 2048 bit signature at the end of the file. Ouch, not good news. So, from everything i can see, it is signed with the ESN by Ford at download time. Not surprised. So, how to make my ESN = one in the signed license CAB? Which still may not be enough, as it may use anything else as a further hash key to sign the cab. Windows Automotive does elude to the ability to sign CABs to particular modules, so that is likely in play here. ESN happens to be 64-bits.

Windows automotive primer....

Cryptographic Keys

The device manufacturer programs cryptographic keys in the DPS of each device and a unique 64-bit product serial number (a unique identifier for the device).

When an application installation package is signed, it can be bound to a specific instance of Windows Embedded Automotive 7 by the inclusion of the product serial number in the Authenticode signature. Application authentication credentials can be created by a combination of the product serial number as the device name and a derivative of the cryptographic key as the password. Note that both the application and the remote service must use a salt to derive the actual password from the unique cryptographic key for each Windows Embedded Automotive 7 device. For example, you can create a salt from a Secure Hash Algorithm (SHA) hash that concatenates the key and a string that corresponds to the service URL.