yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] hugomtiggemann:
and if we created a .bin file with the easyconnect installation and a simple autorun file, naming it as install.bin and putting it inside the folder (SyncExtPack)?
[Windows Mobile Development and Hacking General] performanceisland:
anyone know what to change?
[Windows Mobile Development and Hacking General] vandyman:
Check on the Forscan forum, I think I read about your question (topic) there awhile ago.
[Windows Mobile Development and Hacking General] ric84:
Guys, i hope you succeed with your research to get mirrorlink, because i want it too for my retard sync 2 :)

thanks in advance, if anybody can share in here the final solution.
[Windows Mobile Development and Hacking General] fblasot:
Only with the original ford backup camera you can have the guidelines and the relative byte is in the BCM module, not in Apim (that is what I did when I add original Ford backup camera to my focus MK3.5).
[Windows Mobile Development and Hacking General] santixlp:
sync2 navi

Hello friends, when i use Sothink SWF Decompiler to decompile swf file, the result of the script file is completely different from the JPEXS program, there is also a part of the code of the red rectangle hidden in the block
[Windows Mobile Development and Hacking General] BeciMester:
How is it different? Anything useful?
[Windows Mobile Development and Hacking General] YellowFocusST:
Hey, I've got sync2 in my car with nav and would like mirror link. How can I help the group? I've got a little background in computers but haven't done any serious programming in 10 years.
[Windows Mobile Development and Hacking General] Xcorpia07:
318/5000

Hi guys, can someone pass me the jpg? original unmodified ??? is that I lack variables and also the if statement. Since I only have the modified one.

I'm trying to decrypt well all code to be executed internally as basing the appconsole.swf that comes the upgrade to 3.10.
[Windows Mobile Development and Hacking General] gsilsby:
Disabling in Motion lock

Using ForScan how can I disable the in motion lock for texting and NAV? Also is there a way to allow access to Android on Sync 2?
[Windows Mobile Development and Hacking General] kmust:
I'm interesting in app for MFT.

I can't get the syncExtpack. Please PM me the download link for all the files.

Thinks.
[Windows Mobile Development and Hacking General] chabrzdy:
can anyone send me a link to the navitel ( full zip)
[Windows Mobile Development and Hacking General] orlandson:
Here you can download the .zip with all the files for navitel

https://yadi.sk/mail?hash=pbvkHJtWu4UUoMfuLcxiv1/rIG2e4ZpnOt7CDsl+oE0=

It's from the italian Ford forum https://fordfocus.forumcommunity.net/?t=60544582&st=405
[Windows Mobile Development and Hacking General] kmust:
think you.:good:
[Windows Mobile Development and Hacking General] maraca:
hi people,

I have an update sent to me from Russia for the mirrorlink software. Do you need me to upload it?

Of course it is surely signed for the serial number of my sync2
[Windows Mobile Development and Hacking General] COMpulse:
Go for it. When was it provided to you?
[Windows Mobile Development and Hacking General] wayneace8888:
We need one provided within 3 days as apparently they have a time limit on installing them
[Windows Mobile Development and Hacking General] maraca:
a month ago, a very good mirrorlink software update

in the update only have one archive . install.bin , nothing else

I hope that those who know programming can decipher how the installer works

https://www.dropbox.com/s/jsz4ufqagjej0ja/SyncExtPack_YV4M0096_UpdateMirrorLinkEN.rar?dl=0

---------- Post added at 12:50 AM ---------- Previous post was at 12:49 AM ----------

yes, you're right, but it can be used to decrypt the installation file
[Windows Mobile Development and Hacking General] chabrzdy:
can some1 make me file to my sync2? --> XT79F9Y7 <---
[Windows Mobile Development and Hacking General] orlandson:
It's not working yet.
[Windows Mobile Development and Hacking General] Xcorpia07:
What is very clear is that the jpg is only the installer of the UpdateInstaller.dll 100% safe.

The jpg I think the simplest thing would be to create a new one, I do not see it very difficult. But the problem is in the dll file

The dll is responsible for executing or unpacking it when the Install.bin file is found. The great achievement would be to decrypt the dll since no dll. of the official update of ford are not windows dll and I can not open or read anything in them.
[Windows Mobile Development and Hacking General] COMpulse:
The program I wrote for making your own JPG is here:

https://mega.nz/#!AEZ2hADD!YPlNcj0OMvLlEe992KotOT49NlQJlncPrX1Mbv_gnN4

Included in the package:

A mirrorlink installer.jpg and a navitel installer.jpg.

Both are already decompressed and modified to APIM ID "ABCD1234" to protect the original providers of the files.

The program can find a specified APIM ID in the JPG and replace it with a new one.

In this case, you want to replace ABCD1234 with your APIM ID.

Click BROWSE to select one of the included JPG files to modify.

Click FIND ID OFFSET and the program will locate the current APIM ID in the file.

Enter your APIM ID and click MAKE NEW JPG to save a new JPG with your APIM ID.

Use the new JPG as your installer.jpg

The source code is included for anyone that doesn't like downloading random EXE's off the internet.

NOTE: THIS STILL DOES NOT MAKE THE INSTALLATION WORK. IT JUST LETS YOU MAKE YOUR OWN JPG TO MUCK AROUND WITH THE NEXT STEP.
[Windows Mobile Development and Hacking General] Xcorpia07:
Thanks Compulse. You are the best.
[Windows Mobile Development and Hacking General] maraca:
exellent work COMpulse!. but not all the installers have .JPG

the last i send do not have, only .cab

its not mandatory the .jpg rights?
[Windows Mobile Development and Hacking General] COMpulse:
I have no idea at this point.

It sounds like you guys are able to install mirrorlink/navitel updates without using the JPG a second time. But I assume you must have to use it at least once the first time. So, I would think that the first time it's used, it's adding something to the Sync system to allow unsigned update packages to install thereafter.

Are you on Sync version 3.08 or 3.10? If 3.10, did you get the 3.10 update from Ford, or from somewhere else?

The .bin file is almost certainly a compressed file in my opinion, since any attempt to compress it yields no reduction in size. Even encrypted data usually compresses a little bit.

I theorize that maybe it's a compressed file format with the header removed, or maybe a compressed file stream.

Also, your previous post had a .BIN file -- not a .CAB file.
[Windows Mobile Development and Hacking General] maraca:
yes, sorry . a .BIN file

i have instlled 3.10 software . downloaded from internet. no original update

Exellent work with .JPG

the .JPG installler is a some kind of script for install a .BIN or .CAB file ?
[Windows Mobile Development and Hacking General] COMpulse:
From what I could surmise, the JPG uses FileBrowserPlugin and the FBCopyFile function to facilitate the copying of:

/USB Disk/SyncExtPack/UpdateInstaller.dll

to

windows/UpdateInstaller.dll

After that, the JPG uses the NativeApplet plugin to execute UpdateInstaller

From there... ?
[Windows Mobile Development and Hacking General] Griffin02:
Sorry totally new to this site but I've spent my fair share of RE'ing video games and using windows API's.

It would make sense they don't always need the exploit, since it appears the exploit copies and replaces the original UpdateInstaller in the windows directory of the OS of MFT.

I'm kind of half tempted to reverse the exploit and pull the original UpdateInstaller from the OS by reversing the file paths, as that might give a clearer picture since the original won't be packed. I know his is custom but it's obviously got some protection on it
[Windows Mobile Development and Hacking General] Xcorpia07:
The JPG is a script to copy the UpdateInstaller.dll to the system, and from there you can run the .bin point files without needing the jpg again. Although I have my doubts if the Update.bin of the Navitel is in charge of it or is just an update for Navitel.
[Windows Mobile Development and Hacking General] COMpulse:
For kicks I decompiled the UpdateInstaller.dll with retdec.

It appears to have produced valid C output. But I'm not able to decipher what it's doing.

The decompiled output is here:

https://mega.nz/#!8MpCWSIC!qDxicKtBIuwZsS0pLn5oWlpgt6n3-5BL-NWKKBHfoTk

Also, I'm still trying to understand this process.

Is UpdateInstaller.dll an existing file on the Sync system that is being overwritten with a modified version?

Or, is this DLL changing something the first time it runs, so that the new DLL will handle updates going forward?

Technically, it might be possible to use the JPG method in reverse, to copy files from the Sync system to the USB drive.

Without a vehicle to play with, I'm stuck.
[Windows Mobile Development and Hacking General] Griffin02:
Im fairly certain its a system dll it's replacing but since i dont know the system files in it I cant be 100% certain.

Im also certain InstallerUpdate dll does something with update.bin as once you run the exploit the only file u need on the usb is install.bin.

And I wohldnt be surprised if the updater was serial locked as well, u can see in the images of the install process the updater shows the serial number.

I ended up buying it from him. I like free things but I also respect the work he's done and it amazes me.

Now the only issue I have is the usb in my F150 doesnt charge my phone fast enough, and a usb y split cable didnt help lol
[Windows Mobile Development and Hacking General] chabrzdy:
is it already working?
[Windows Mobile Development and Hacking General] kmust:
Open bin files with Hexview or other hex/bin view sofeware, I find the first eight group bytes are same in the upadate.bin and install.bin.

anybody could get what is it ?
[Windows Mobile Development and Hacking General] pomyslowy_dobromir:
Coded ESN ?
[Windows Mobile Development and Hacking General] maksiu21:
Who have zip of mirroring?
[Windows Mobile Development and Hacking General] pomyslowy_dobromir:
Post #1066?
[Windows Mobile Development and Hacking General] chabrzdy:
its working>?
[Windows Mobile Development and Hacking General] chabrzdy:
installer resets sync but after changing pack_install to install nothing installs :(
[Windows Mobile Development and Hacking General] czdz:
Has anyone made any progress?
[Windows Mobile Development and Hacking General] bujkopiotr1972@gmail.com:
same me
[Windows Mobile Development and Hacking General] wayneace8888:
Not sure anyone got it to work, we need more people trying, I men come on if one giy done it I'm sure we can, I'm willing to test any too
[Windows Mobile Development and Hacking General] thodoris1985:
anyone has a link to the files in order to download them as well (and try for a solution)?

The link posted some pages back, is not active.

Thanks
[Windows Mobile Development and Hacking General] rioachim:
Ok, something new: just run UpdateInstaller.dll through onlinedisassembler.com and found month names inside it. This makes me think the 3-day install time limit calculation might be done in this DLL. Also run it through Snowman decompiler, but I have no experience with this.
[Windows Mobile Development and Hacking General] bujkopiotr1972@gmail.com:
Hello

I think that installer.dll must also have a serial number added

what do you think about d the dll file is old date stamp

[IMG="pexplorer"]https://drive.google.com/open?id=1OZGVhVdrCOuHgO4-nAt6U9_cbmQQZr99[/IMG]
[Windows Mobile Development and Hacking General] cr08:
I've been scrolling back through the past couple dozen pages trying to find the working links posted. Got a nice folder of stuff here. Mostly just multiple installer.jpg's but there's a full package and the JPG modder. If it's of any use:

https://mega.nz/#!HgJWSKIT!P91h-SNFBEVw1UHc0_jDLu53MWZFewGCzdlySrJmdlw

Sadly can't provide any actual development help but will gladly keep a close eye on this. Very interested in seeing what comes of it. I'd love it if someone could potentially write an Applink emulator or whatever Sync-side connectivity is needed to enable modern Applink apps to work with ours. That was probably the MOST annoying omission early on that was originally advertised to be available with MyFord Touch.
[Windows Mobile Development and Hacking General] kbags:
I have a 2015 Ford Explorer Limited without Nav that had an APIM go bad. Got myself a used APIM from a 2015 Ford Explorer Sport with Nav. Replaced the APIM and it was working well. Modified APIM using ForScan to adjust to only heated seats. Nav appeared in upper right.

Next I needed to upgrade to 3.10 so that the A9 MAP SD card would work. I made the mistake of getting the 3.10 upgrade that was native to my 2015 Explorer Limited without Nav and after installing the upgarde ... the GPS Nav was gone (everything else is working great however).

Realizing my mistake, I download the 3.10 upgrade for the vin associated with my replacement APIM (which has the AG zip files) however I can't install now as SYNC 2 says "I already installed this update".

So, what do I now to get my Nav back? I see the that I have the Navigation License and that I can adjust Navigation options in Settings but still just 'Information' appears in the upper right hand corner of my home screen.

Do I install just the AG.zip files and if so, how do I so? Unzipping EA5T-14F657-AG.ZIP to a USB did not work (started but stated 'not compatible')

I did download the SyncNav.zip files from this discussion which contains 3.10 and Interrogator. Do I install these even though I have a legal, licensed copy of Navigation on my APIM?

Is there a way to 'trick' the system and reinstall 3.10 with the upgrade that is specific for my replacement APIM?

Thank you in advance for any assistance anyone can provide.

-Keith
[Windows Mobile Development and Hacking General] wayneace8888:
Hey mate there is a sync 2 downgrade zip but I wouldn't have a clue where I found it and unfortunately I don't have the zip anymore. I used it as I bricked my sync 2 doing the 3.10 update. I did the downgrade back to 3.08 then upgraded again to 3.10 and it worked fine mate. I'll see if I can try to find the downgrade again but can't make promises. I'll pm you a link if I find it OK.
[Windows Mobile Development and Hacking General] benkej:
Sync3 us to eu

I looking for solution for update sync3 apim us to eu
[Windows Mobile Development and Hacking General] kbags:
Found the downgrade zip file thanks to you! All fixed!

For what it is worth, after the downgrade to 3.08 the Nav was working. Then updated to 3.10 with the version for the vin associated with my new APIM (with Nav, has the ...AG.zip file). Now Nav is working great with 3.10.

Thanks again!

-Keith
[Windows Mobile Development and Hacking General] wayneace8888:
My pleasure mate, glad it's all sorted and working
[Windows Mobile Development and Hacking General] kjawo:
Hi Guys! Someone try package from this russian forum?: http://mondeoclub.ru/forum/topic/147921/?page=3

Package on hosting:

https://yadi.sk/d/uniHBj_zk82Sc
[Windows Mobile Development and Hacking General] maraca:
Hi, this app for sync2 serial YU5V01LR only sadly
[Windows Mobile Development and Hacking General] kjawo:
Can we modify this parameter to our own? Will it work?
[Windows Mobile Development and Hacking General] thodoris1985:
I have no idea what I am doing, but has anyone else opened the jpg file and found "function a()"?

In there I managed to find the code of the APIM (var "_loc21_"). However I noticed that some numbers of the coded APIM, are also included in some other variables. Would that be the case or it is just a coincidence?

Nevermind I just read this post here and cleared things out

--- edit ---

if we change the code

from

var _loc24_ = _loc17_[d(_loc9_)](d(_loc12_),d(_loc11_));

to

var _loc24_ = _loc17_[d(_loc9_)](d(_loc11_),d(_loc12_));

would this get the dll from our car into the usb and then we could compare it with the modified one?
[Windows Mobile Development and Hacking General] wayneace8888:
Try it and let us know haha, we've tried a few things on here, one guy wrote a program to modify the APIM serial to your own for the .jpg file but the second part of the installation doesn't start. They think it's something to do with the .dll file but not sure. The Russians obviously figured it out and at the only ones to get it working so far and apparently the file they send out only works for a set amount of time. If we can stop the time expiring then I think we can get it working.
[Windows Mobile Development and Hacking General] thodoris1985:
I could try my method above, but I only have the jpg file and nothing more (meaning that I dont have the UpdateInstaller.dll the install.bin and the update.bin).

I already modified the code using ffdec and also downladed the program made by (I think) [MENTION=3694909]COMpulse[/MENTION] so I think I am good to go, however its better to have the dll, otherwise there is no point on continue modifying anything.
[Windows Mobile Development and Hacking General] COMpulse:
PM sent with DLLs
[Windows Mobile Development and Hacking General] wayneace8888:
Let's hopefully pick this up again
[Windows Mobile Development and Hacking General] thodoris1985:
First of all I will modify the jpg file with my APIM serial as well as the change that I describe on my previous post.

I just want to see, if the dll file is there prior to any modifications that I am going to make
[Windows Mobile Development and Hacking General] thodoris1985:
Just a quick question.

When any of you tested the new compiled jpg, did you also remove the SD card used for the navigation?

I am asking, because in the installation Process (PDF), it states that all USB cards should be removed prior to the installation.
[Windows Mobile Development and Hacking General] COMpulse:
I don't have a Ford to test with right now, so I'm mostly useless at this point.

But how about, instead of trying to get a single piece of software to work, let's try to use this to open a file browser and get access to the system so we can install Windows CE packages.
[Windows Mobile Development and Hacking General] wayneace8888:
Is it possible then mate?
[Windows Mobile Development and Hacking General] thodoris1985:
The point with me is that I don't have any knowledge as a developer (I am not one), so I am a bit blind to all this.

I do understand something when I read it (for example the jpg) but I cannot build something, only think of some changes to add on an existing code.

Anyway, I just tested the change of the code that I suggested, but it didn't do nothing. I used "ffdec" for my change and the script of COMpulse for the edit in the APIM serial
[Windows Mobile Development and Hacking General] thodoris1985:
[MENTION=3694909]COMpulse[/MENTION] is there any way of interchanging loc11 and loc12 strings without opening the file?

One way that I think of, is by removing the 8 characters check from the program you made. (I found the check on "Form1.vb" but I don't know how to recompile it)

I believe that by making the change myself (by opening the file) it made it corrupt. Then when I load it via usb in my car, nothing happened (no reboot).
[Windows Mobile Development and Hacking General] oscarj2m:
Hi guys, I am enabling reverse camera in Mexican Ford fiesta 2018 I edit 7D0-01-01 xXxx, I have tried 2 and A but the figure of car with proximity sensors around does not appear, anybody knows how enable it
[Windows Mobile Development and Hacking General] thodoris1985:
If you had the figure prior to the installation, it should also appear now after the installation of the reverse camera.

On the following picture you will see an example of the characters that you should change

On the above example you should add 2 on the number 9 and it should become B.

On the above example, on number 55 you should again add 2 (this is the checksum) and then it should become 57.

Save and exit forscan.

On focccus, you should change attribute 99 to value "2 (With Park Assist Camera)"

If I can recall correctly, on this link there is a very good guide regarding as-built.

The above where the only software changes I made on my car in order to enable the camera.

--- edit ---

Just a quick note: The above changes applied to a European ford focus 2015. So I am not sure if the same applies for your car

--- edit 2 ---

Also you may find the below settings in the APIM menu (maybe the park pilot, enables the figure as well?)
[Windows Mobile Development and Hacking General] COMpulse:
I looked into this today. Unfortunately,

the names of the variables

are not used in the JPG. Only their textual values. The variables themselves are just non-identifiable pointers in compiled code.

If you want, send me your APIM ID and I will try making you a JPG with the source/destination reversed in the copy command.

When modifying the JPG in JPEXS, I try to just edit the P-Code section.

I've got other ideas too, but without a vehicle, I can't do much.
[Windows Mobile Development and Hacking General] thodoris1985:
I thought of changing the textual values and not the variables (e.g. loc11 and loc12).

Meaning to look for "/USB Disk/SyncExtPack/UpdateInstaller.dll" and change it with "windows/UpdateInstaller.dll" and vice versa.

Anyway, I will send you the APIM so that you could try as well later on when I get home.

Thanks
[Windows Mobile Development and Hacking General] COMpulse:
Swapping the two strings may not be possible either, since binary file formats usually have fixed-length strings, pointers, and offsets. So in most cases, the length of the string cannot be changed without a recompile.
[Windows Mobile Development and Hacking General] jonro2009:
Hi, I'm hoping you can help [MENTION=1116899]fblasot[/MENTION] I tried to PM you but haven't been able to.

I have a 2017 UK focus with sync3, I don't have parking sensors or the module on the o/s wing. Which also means that I do not have the plug that you can connect the camera to.

I have activated the camera service using Forscan so now when I select reverse the screen goes black and the screen says 'camera not available' which is what I expect seeing as there is no camera connected. I have purchased a 54pin APIM loom bridge with a yellow RCA socket to receive the cameras RCA, the socket is connected to the correct pins to show a picture in the screen. The bridge won't arrive until mid Feb though. I will wire the camera to the reverse light for power, or an ACC fuse.

The camera arrived today and I powered via a fuse tap just to test it and connected it to an old TV via RCA, it displayed a picture but only when the earth was not connected, and the picture is black and white. The parking distance grid shows on the screen.

Finally, here are my questions..

1. Do you think this setup will actually work?

2. Why would the picture only be visible when the camera is not earthed?

3. Why would the pic be in B&W?

I think the answer to #3 is something to do with PAL/NTSC and I hope the Sync unit will display in colour.

Sorry for all the questions and for sending you a PM, I hope you don't mind and can help. I did the same upgrade on my MK5 Mondeo but did not require the bridge as the plug was there in the boot, I just had to cut the plug off and join the correct wires up
[Windows Mobile Development and Hacking General] oscarj2m:
Yes will be function, all described is ok, the image in B&W due to signal encoding NTSC or PAL

In other theme maybe anyone has a South America image of SD card maps for sync2?
[Windows Mobile Development and Hacking General] Thaur250:
I have one

Let me get home and I will search for the link where I downloaded my copy. If I can't find it I'll upload the file for you.

Saludos
[Windows Mobile Development and Hacking General] kilumnati:
I have sync2 with navigation, how can i enable mirroring on it. thanks
[Windows Mobile Development and Hacking General] COMpulse:
Still testing some different ideas to open up the Sync 2 system. Haven't given up just yet.
[Windows Mobile Development and Hacking General] wayneace8888:
Nice one [MENTION=3694909]COMpulse[/MENTION], can't give up mate lol