yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] sensorial:
Okay, I'm going to test and let me know if it will damage the unit.
[Windows Mobile Development and Hacking General] hamody357:
see this youtube how to install it
[Windows Mobile Development and Hacking General] hamody357:
and this after u by it am sorry arabic lang
[Windows Mobile Development and Hacking General] sensorial:
Cool !!

Thank you very much for your help and files.

IDE TEST how it works. Are there any bugs I hope not. Keep fingers crossed.
[Windows Mobile Development and Hacking General] sensorial:
The file contains a demo or full Client version?
[Windows Mobile Development and Hacking General] bigorat:
were you able to install the package on the device? Any of the programs in the package work?​
[Windows Mobile Development and Hacking General] sensorial:
After installing the package, the MirrorLink button appeared but after pressing SYNC2 it resets :(

I am looking for a solution to the problem
[Windows Mobile Development and Hacking General] bigorat:
Any other apps? Do they work?
[Windows Mobile Development and Hacking General] JasonACT:
Installing the Russian mirrorlink package closes the Sync2 shockwave vulnerability, I.E. the install.jpg/png image file which is really a script, I think they did that, not sure why... I.E. The sat-nav image file hack will not load once this is installed. But attached is some source code that will take one of your packages (the one ending in D5, but can be changed to work on others) and convert it over to your own serial number, but it must be installed within days. You need to check out the code to see how/what it does.

Be warned though, you will need to re-install the Ford sync2 software package (to remove mirrorlink) to get back the ability to use the image vulnerability.
[Windows Mobile Development and Hacking General] JasonACT:
File attached
[Windows Mobile Development and Hacking General] JasonACT:
Compiled .exe too, zipped in this archive.
[Windows Mobile Development and Hacking General] JasonACT:
Ok, I see the .exe is more popular than the source code... Make sure you decompress the Installer.jpg file with flasm.exe -x - and rename it to what the program complains about, it won't search/edit the compressed file. BTW: I personally re-compressed it with flasm -z (not sure it matters).
[Windows Mobile Development and Hacking General] sensorial:
Okay, one attachment has a .cpp file and the other has an exe

What to do with it, please write step by step in simple points.
[Windows Mobile Development and Hacking General] rioachim:
Wait a little more for someone else to do it, Jason has done more than enough. Thank you, will test it tomorrow, great code, clean and structured.
[Windows Mobile Development and Hacking General] sensorial:
Ok please tell me if this apply to files from hamody357 ?
[Windows Mobile Development and Hacking General] rioachim:
can't get installer.jpg to run on my 3.10, it just displays "protected by secureSWF Demo version." after the whole decrypt process. Did you use the jpg file from D5 package as a starting point?
[Windows Mobile Development and Hacking General] JasonACT:
Yes. My program would have complained if you used any other. But, I have noticed if you are trying this stuff with "broken" files, it leaves the Sync 2 unit in a state where it doesn't run even when the files are "good". You need to reset the Sync 2 unit (so it's "fresh" :)) and then try.
[Windows Mobile Development and Hacking General] JasonACT:
(In addition, I recompressed it too... But I'd be surprised if that is needed - but certainly a fresh boot helps - that's for sure.)
[Windows Mobile Development and Hacking General] JasonACT:
One other thing, I noticed the installer dll looks up the timezone... But since I'm in Australia (10 hours ahead) it didn't use the values. Maybe it does if you live behind 'SystemTime', but then that would only affect the install if the algo produced a number on the cusp of the switch-over day... Which is about once a month.
[Windows Mobile Development and Hacking General] rioachim:
Thank you, I will downgrade to 3.08 to start fresh and check the system time and files timestamps in relation to GMT.
[Windows Mobile Development and Hacking General] JasonACT:
I certainly didn't need to downgrade from 3.10. I've never even had 3.08 on my unit. But I needed to upgrade to 3.10 for it to work... The version before 3.08 apparently doesn't have the vulnerability at all.
[Windows Mobile Development and Hacking General] JasonACT:
Does this look about right?

Directory of E:\SyncExtPack

23/04/2022 07:18 PM <DIR> .

23/04/2022 07:18 PM <DIR> ..

09/06/2007 10:32 PM 155,648 flasm.exe

22/04/2022 02:59 PM 61,322 Installer.jpg

18/04/2022 02:25 PM 61,322 Installer.swf

22/04/2022 02:59 PM 12,328,000 pack_install.bin

22/04/2022 02:59 PM 12,327,993 pack_installCHK.bin

17/12/2018 04:36 PM 12,328,000 pack_installD5.bin

22/04/2022 02:59 PM 1,395,824 update.bin

22/04/2022 02:59 PM 1,395,821 updateCHK.bin

17/12/2018 04:36 PM 1,395,824 updateD5.bin

23/04/2022 12:04 PM 86,016 decrypt.exe

17/12/2018 04:36 PM 10,240 UpdateInstaller.dll
[Windows Mobile Development and Hacking General] rioachim:
Of course it does and on the USB stick there will be only 4 files, the jpg script (unpacked/decrypted/repacked), the 2 modified bins (update and pack_install) and the dll. I have to revert to a clean system state and try again.
[Windows Mobile Development and Hacking General] sensorial:
How to downgrade from 3.10 to 3.08 I have both. Is a special autoinstall
[Windows Mobile Development and Hacking General] rioachim:
@sensorial, relax, you clearly don't understand what has been posted so far and you just have to wait a little while for step-by-step instructions.
[Windows Mobile Development and Hacking General] sensorial:
Can you upload all files in one link? Do I need to generate installer.jpg from serial SYNC2?

File on MEGA

mega.nz

All MirrorLink files are in the link

VideoPlayer

Navitel

Manual and Serial Number Generator for Installer.jpg
[Windows Mobile Development and Hacking General] rioachim:
@sensorial, tell me your sync SN and I will generate the package (mirrolink/easyconnect only!) that you can test.
[Windows Mobile Development and Hacking General] JasonACT:
FYI - I was also able to install that old Navitel version... But that uninstalled MirrorLink! The update package cleans up before putting in new versions of software (makes sense, you don't want endless installs). My unit has nav already though - and Navitel doesn't support Australia, so after looking at a couple of screens, it was removed.
[Windows Mobile Development and Hacking General] rioachim:
which apk version of carbit easyconnect did you try? playstore / v6 / v8?
[Windows Mobile Development and Hacking General] JasonACT:
I just used my decrypt software on the one in the archive linked here.
[Windows Mobile Development and Hacking General] sensorial:
OK, proszę YV3301B2
[Windows Mobile Development and Hacking General] flsdiver:
WOW!!! TOTAL SUCCESS!!!

NAVIGATION NOW ENABLED ON THE TRUCK!!!

Thank you to Forscan team. They were wonderful to work with in getting ELM327 working on HSCAN/MSCAN and enabling APIM as build flash. Awesome software! Please don't nag them about the software, they will release soon i imagine.

Thank you to members here for hints/clues/files.

Thank you to ford.

Now the good part...

1) Program APIM as build with bit mentioned in thi thread.

2) Program ACM as build with bit mentioned in this thread. Not sure needed/what it does but i did it anyway.

3) Download license (BT4T-14F500-BE) and nav software pack (EA5T-14F657-AD hint! in my case)..

4) Flash this as normal usb stick update.

5) Stick in A7 nav SD Card.

6) Enjoy the trip!

There is no need for a total APIM flash...maybe that was posted to get past step 1 i did with forscan.

3) is tricky, i finally nailed it. What i posted earlier today (just updated zip with more accurate information) is very close to working download for your vehicle, just use your VIN/ESN/part numbers. Hint!

Get the xml (format is SYNC_ESN_VIN.XML) from the normal usb update from your vehicle, it has needed information (you can get this from ford/sync website and run it on USB stick) Hint!

Get the license/software pack while you can, f0rd can shut this down anytime i imagine.

I guess I will have to RTFM now?

This thread just got really fun!
[Windows Mobile Development and Hacking General] lucasb8888:
Thank you flsdiver

I just did steps 3 and 4 on my truck and it seemed to have worked. If I go to Information > Apps > Install Apps/ Updates > View Software Licenses I see it in there.

Thanks again.
[Windows Mobile Development and Hacking General] MarcinXDA:
Wow!!! [MENTION=7376032]flsdiver[/MENTION] Good news!!!!
[Windows Mobile Development and Hacking General] COMpulse:
I think I just need to understand where to get the ESN...
[Windows Mobile Development and Hacking General] lucasb8888:
If you still have the files from when you did your last sync update. There is an xml file under the syncmyride folder. The ESN is in the file name and also in the contents of the file. if I remember correctly this is the file you upload to f0rd after you successfully updated you sync
[Windows Mobile Development and Hacking General] COMpulse:
If you mean the downloaded update (named like Gen2v38build15128updatepackageNARev2 or EA5T-14D544-AD), there's no XML under syncmyride. Just CABs and ZIPs.

Or is this info written to the SD from the car after an update?

Ahh.. I never did the upload back... Gotta do that I suppose..
[Windows Mobile Development and Hacking General] lucasb8888:
It's written there after the update
[Windows Mobile Development and Hacking General] flsdiver:
Diagnostics is one way...Eject Button hold down then hold and press the right next song button. Cancel the tone test asap, it's quit annoying. it's listed in there with some other part numbers.

Or it's in the xml from ford when you do a normal update, or if you download and run the sync utility that reports this on the usb stick.

Later is better, has even more information needed. But need utility for it or latest update from usb stick report to f0rd file.

Extract this zip onto usb, it will put that xml file on usb when inserted into vehicle, take 1 minute or less. Direct from F0rd if you don't have the update files on usb from last upgrade anymore.
[Windows Mobile Development and Hacking General] sheltonfilms:
My phone notifications have been firing off.

Woke up to see this. Good job guys!
[Windows Mobile Development and Hacking General] COMpulse:
Downloaded your ZIP but it wouldn't run in my car.

Downloaded latest update but it says I'm already up to date.

EDIT:

Maybe it auto installed correctly, and then just errored when i tried to also install it manually.

EDIT 2:

I must be close. But all i get is a web exception from the URL so far..
[Windows Mobile Development and Hacking General] rioachim:
Yes, that happened to me at first. Probably the server needs some time before registering the new ESN. Keep trying, use a nav enabled vin, I don't know what triggers it.
[Windows Mobile Development and Hacking General] COMpulse:
Wait -- use a nav-enabled VIN? Not my own VIN?

---------- Post added at 08:19 AM ---------- Previous post was at 08:15 AM ----------

I've hit that server 20 times and failed. I'm gonna wait for someone to hand-hold me through it instead of beating up that link...
[Windows Mobile Development and Hacking General] lucasb8888:
I used my own information found in the xml file
[Windows Mobile Development and Hacking General] COMpulse:
ESN from Sync: Sync_XP390D8Q_1FAHP2KT5DG113043.xml

From .AB:

-<NODEID>

7D0

<F111>BM5T-14F130-AB</F111>

<F113>DA5T-14D212-AD</F113>

<F188>BT4T-14D205-BF</F188>

</NODEID>

So the URL should be....

1FAHP2KT5DG113043/

XP390D8Q/

BM5T-14F130-AB/

DA5T-14D212-AD/DEALER?cspn=

BT4T-14D205-BF&ccpn=&vp=P5&rswfpn=&iswfpn=

EA5T-14D544-AD&uswfpn=&timeout=30000

1FAHP2KT5DG113043/XP390D8Q/BM5T-14F130-AB/DA5T-14D212-AD/DEALER?cspn=BT4T-14D205-BF&ccpn=&vp=P5&rswfpn=&iswfpn=EA5T-14D544-AD&uswfpn=&timeout=30000

No luck. No idea where I'm screwing this up.
[Windows Mobile Development and Hacking General] lucasb8888:
Please don't post the url. I believe that was the point of having the url in the excel file
[Windows Mobile Development and Hacking General] COMpulse:
(url redacted)
[Windows Mobile Development and Hacking General] lucasb8888:
Thanks

Try using the values that are within the xml file instead of the ab
[Windows Mobile Development and Hacking General] ptodic:
Great team effort! However I would prefer the "install unsigned/hacked cab" method. It would open so many possibilities...
[Windows Mobile Development and Hacking General] flsdiver:
zip to get the xml i posted probably only runs against BT4T-14D546-EE.CAB, that should already be on you vehicle, if not, your version is different software, and sync owners site would give you a different one.

web exception, boy did i get a million of those before it clicked...the software version for your vehicle for nav is probably not right for iswfpn argument.

try with current -EE.CAB that is on your vehicle. look at your current autoinstall.lst for your vehicle....

Item1 = BT4T-14D546-EE

Open1 = SyncMyRide\BT4T-14D546-EE.cab

was mine.

If you run the url agains the EE cap you should get the zip with EE and the sync status downloader that puts the XML on your usb.

---------- Post added at 02:18 PM ---------- Previous post was at 02:17 PM ----------

Oh i agree, this is not hacking MFT, this is purely enable nav door that was left open. nothing is 'hacked'.
[Windows Mobile Development and Hacking General] sensorial:
Wygląda świetnie :) Potrzebuję instrukcji krok po kroku, jak sobie z tym poradzić
[Windows Mobile Development and Hacking General] rioachim:
check pdf for instructions, run from a SyncExtPack USB subfolder
[Windows Mobile Development and Hacking General] rioachim:
@JasonACT, I would say the issue is with the generated Installer.jpg (already tried a clean install and different time settings). Did you use flasm 1.62 for unpacking?
[Windows Mobile Development and Hacking General] sensorial:
WOW Thanks a lot. Tell me please, the flash drive, we format FA32. Copies the contents of the link to the created folder with the name SyncExtPack in the middle must be only :

Installer.jpg

pack_install.bin

update.bin

updateinstaller.dll

Installer.jpg file did you get my SYNC serial number ?? We have a time file here, can I install it later?
[Windows Mobile Development and Hacking General] JasonACT:
Yep, 1.62. You don't even need to view it if it works - the Sync 2 just resets a few seconds after installing it.
[Windows Mobile Development and Hacking General] rioachim:
Wait a second, the folder naming, I always have had run it from the USB root. Thanks @sensorial for the heads up, please try from a SyncExtPack subfolder
[Windows Mobile Development and Hacking General] JasonACT:
Yeah, that won't work :)
[Windows Mobile Development and Hacking General] sensorial:
Let's summarize :) we have all the files for Mirror and we have a serial number generator for the installer.jpg file

link below

File on MEGA

mega.nz
[Windows Mobile Development and Hacking General] rioachim:
Yes, install woked just fine this time (many thanks @JasonACT), but I managed to crash the UI twice already. Tried to find a suitable easyconnect app, entered connection settings inside the installed mirrorlink package then the app stole focus and I could not interact at all with the screen and back button was not working. I had to restart to safe mode and back to normal to kill the easyconnect car app. Still trying to connect properly
[Windows Mobile Development and Hacking General] JasonACT:
Bloody Russians!
[Windows Mobile Development and Hacking General] rioachim:
Neah, they did what they could, the app is Chinese. It still amazes me how they were selling this buggy solution
[Windows Mobile Development and Hacking General] JasonACT:
I chuckle, and yet, won't repeat myself even though it may be appropriate.
[Windows Mobile Development and Hacking General] sensorial:
CarbitLink-EasyConnection - Apps on Google Play

CarbitLink is your driving assistant.

play.google.com

Werion 4.0.1 offical shop Google Play English
[Windows Mobile Development and Hacking General] rioachim:
For those willing to experiment, if your phone is not compatible and the car app locks up, use the attached archive unzipped to USB root to reboot to Safe Mode and back to Normal Mode. The procedure autostarts, but right after the second reboot (after "Installing file 1 of 0" prompt) you will have to take out the stick manually, otherwise it will reboot over and over again.
[Windows Mobile Development and Hacking General] bigorat:
Guys, how do I convert the package step by step to my sync serial number?
[Windows Mobile Development and Hacking General] rioachim:
run "decrypt.exe SYNC_SN_VALUE" and follow PDF instructions inside attachment
[Windows Mobile Development and Hacking General] JasonACT:
I profusely apologise, but at this point, I will bow out - this thread has been a great read, and I appreciate sensorial's fabulous download package, that last week, caught my attention. But realistically, in my part of the world, this isn't on our radar... not to mention, my car has a pre-sync2 system that I had considered replacing with the next iteration (which is why I have a bench test Sync2 unit) but that was from 2 years ago... And I've already properly hacked my Australian non-Sync(2) touch system for VNC client access to a Raspberry Pi from an ESP8266 add on WiFi component.

I do wish you all good luck though. I think my decrypt software may serve you well.
[Windows Mobile Development and Hacking General] bigorat:
@JasonACT can you improve your program to decrypt to other APIM numbers? For example, to make it so that on the command line to specify decrypt.exe FromAPIMSerial toAPIMSerial? What would the program not depend on one particular APIM D5?
[Windows Mobile Development and Hacking General] rioachim:
You want to run it on other packages, but other packages might have a different structure at some point. I would say it is easier in its current form, plus the source code can be adapted if necessary
[Windows Mobile Development and Hacking General] bigorat:
@rioachim so it would be universal when one APIM is original and the second is for replacement, and if the package is not correct, the program will simply give an error. For example, I have nowhere to compile the source code at all, that's why I'm talking about this option
[Windows Mobile Development and Hacking General] rioachim:
In the light of recent developments, what is the mirroring app that you used inside your project instead of easyconnect?
[Windows Mobile Development and Hacking General] Daedaluswq:
Seems like there is still a problem to solve this
[Windows Mobile Development and Hacking General] tigerpro357:
Just looked back in here, seems like a lot has happened since I last looked, so couple questions since it looks like there may be a few gaps in info.

Is the last link that's posted a "generic" S/N link or does it require editing?

Is there still a "timer" or has that been found/removed?

Thank you in Advance
[Windows Mobile Development and Hacking General] Juanpereyra99:
Hi, I don't have any knowledge about coding, I mean absolutely 0. But I did have an idea and in my logic at least it makes sense.

I'm from Argentina and I almost bought the patch from a Colombian distributor (some of his YouTube videos have been posted in this thread). I casually asked him if I could install mirror link more than one time in my sistem, due that my official ford service made a factory reset of it last time I gave them my Fiesta to be checked up. So if that happened again, I will lose the mirrorlink app.

He told me that the patch was only available through the month which in has been coded. So, what if stop trying to figure out how to modify the "timer", and instead, change the sync 2 sistem time and date to the month that the patch has been coded.

It's definitely going to be easier, we just have to look the last date windows says that the file has been modified. Or try to ask one of the people that did buy it in the past, when did they install it, then change the sync 2 sistem we are trying to install the patch to that specific date. And who knows, if the serial number has already been figured out, maybe that's it.

Sorry if it's a stupid comment, I don't have any clue, but in my head makes a lot of sense, maybe it's worth a try.
[Windows Mobile Development and Hacking General] tigerpro357:
I am also curious about this
[Windows Mobile Development and Hacking General] sensorial:
Gentlemen, how to put it together?

I have a generated installer.jpg file under my sync2 serial number by the user rioachim (Thank you)

and I have D5 files what should be on the flash drive in the folder E:\SyncExtPack ??

https://xdaforums.com/attachments/sync_mirrorlink_yv3301b2-zip.5596099/

https://xdaforums.com/attachments/syncextpack_d5-zip.5596207/

E:\SyncExtPack

23/04/2022 07:18 PM <DIR> .

23/04/2022 07:18 PM <DIR> ..

09/06/2007 10:32 PM 155,648 flasm.exe

22/04/2022 02:59 PM 61,322 Installer.jpg

18/04/2022 02:25 PM 61,322 Installer.swf

22/04/2022 02:59 PM 12,328,000 pack_install.bin

22/04/2022 02:59 PM 12,327,993 pack_installCHK.bin

17/12/2018 04:36 PM 12,328,000 pack_installD5.bin

22/04/2022 02:59 PM 1,395,824 update.bin

22/04/2022 02:59 PM 1,395,821 updateCHK.bin

17/12/2018 04:36 PM 1,395,824 updateD5.bin

23/04/2022 12:04 PM 86,016 decrypt.exe

17/12/2018 04:36 PM 10,240 UpdateInstaller.dll
[Windows Mobile Development and Hacking General] Daedaluswq:
Did you solved demo version problem with installer.jpg?
[Windows Mobile Development and Hacking General] JasonACT:
I'm writing this only to provide ideas to developers here... but I've written my very own first version of UpdateInstaller.dll (ARM-THUMB, WindowsCE 6.0, Using Visual Studio 2008, which is actually lucky because that's what I normally use)...

The program, a file-system walker, which simply produces a file with what files it sees when traversing directories.

I get to run it once, then need to power down and restart the unit before I can run it again.

Attached are the filenames my program can see. Next up will be actually copying the files to the USB stick. Don't expect anything from me anytime soon though, I'm back at work on Tuesday.
[Windows Mobile Development and Hacking General] tigerpro357:
That is looking pretty promising, makes me think if we can modify the right file for ... Say Navigation, to instead launch explorer we could actually get quite a bit more working fairly easily. I will have to keep an eye on this thread more.
[Windows Mobile Development and Hacking General] tigerpro357:
Ok, I just tried this and here are my notes/take aways for anyone else that's going to do this, first, the process is easy if you look through this thread for the info you need, the TL:DR version is "decrypt <APIM S/N>" then follow the directions in the pdf, it really is that easy to install. Now for the caveats that may be just me or across the board, regardless YMMV, I tried running easy connect with a Galaxy Note 10+ running factory Android 12, the app store version would not connect to the sync 2 system, regardless of what I tried. The app on sync 2 does present a QR code for a app that is all Chinese, and as far as I can figure out, there doesn't appear to be a way to set it to English, however that app was able to connect to sync 2, but since the entire interface was in Chinese, (I'm assuming Chinese based on the info in this thread btw) I was unable to do much else. For moving forward, I will try testing different devices (I have a few to try) and see if the android version matters, as well as if the app version is a factor. I will report back in a couple days after some real world testing as well.
[Windows Mobile Development and Hacking General] rioachim:
https://disk.yandex.ru/d/-bCJ8UR9tjKSOQ/6.8.0 (tested on Android 12) but it's quite useless because in Waze or Google maps the phone screen must be always on and unlocked to be mirrored and no Sync2 touch input is possible in mirroring mode.