yashsingh1/xdaforums huggingface dataset:
[One (M8) Q&A, Help & Troubleshooting] redpoint73:
You've tried using data, such as browsing webpages, etc. (with WiFi turned off)? Does data work at all? Still no icons, even after using internet.

---------- Post added at 09:47 AM ---------- Previous post was at 09:37 AM ----------

The "2G" at the end doesn't indicate 2G internet (vs. 3G or LTE) if that is what you are thinking. The radio number is just a string of numbers and letters. Mine for instance has "1_F" at the end.

I don't know the radio number for the MM Dev Ed off hand (they used to include it in the RUU file name, but didn't do that this time for some reason). 1.29 is a Marshmallow radio, that I can say for sure. And if the Dev Ed RUU is the only MM RUU, firmware, or radio that you've flashed, than it must be the correct Dev Ed radio. The Dev Ed is intended to work on AT&T, so its the "correct" radio for your current setup and carrier (ATT) as far as I can see.
[One (M8) Q&A, Help & Troubleshooting] samisax:
Double check your access point details and make sure your APN is selected.
[One (M8) Q&A, Help & Troubleshooting] Jerrel7:
So I checked it again this morning and everything seems to be working fine now. Maybe it had to sit for a while before it picked up. But, the update went smooth after flashing the MM firmware only, then running the MM RUU. Thanks for the help guys!!!!

Also, you're right that's what I was thinking about the 2G in the radio version. Now, I know that isn't what that means.........Thanks Again :D
[Windows Mobile Development and Hacking General] rioachim:
you can have it activated for 100$+ shipping to Russia: http://fordexplorernew.ru/index.php/topic,1056.0.html
[Windows Mobile Development and Hacking General] mdl054:
Just more proof we can figure it out. :highfive:
[Windows Mobile Development and Hacking General] rioachim:
I highly doubt it. You need 2 cars with same configuration, one having navigation. Then dump the ABD data, and find the byte that enables nav, change it together with the checksum. Afterwards, you will need Ford IDS and Oasis to do a reinstall on the module, and swap the ABD file. Well, this is just my guess, but for sure additional equipment and paid access to Ford tools is required.
[Windows Mobile Development and Hacking General] mdl054:
I've actually found today a few sites in Russian with people who have figured it out. The problem is the translations.

From google translate I got this (I know it sounds funny but I promise I didn't change any of it lol)
[Windows Mobile Development and Hacking General] mdl054:
Definitely on the right track. I got a second Nav enabled APIM today because I wrecked my last one. I carelessly loaded the wrong update file when I was playing around and used the official ford update (not mine which I never expected to work anyways) which disabled Nav. I've yet to get around the signature issues.

Let me know if you need anything off this APIM.
[Windows Mobile Development and Hacking General] seadiel:
I bought a used NAV enabled APIM as well from w w w.lkqonline.com was only $125+ $12 shipping. It works for my 2013 Fusion, but I have the Fusion Energi and it threw an error (Check engine DTC). I didn't see any reports of other people posting DTC errors when they swapped out non-nav APIM's with nav APIM's from other vehicles. Could be a Hybrid/Energi only problem since there is an additional menu on those cars in myfordtouch.

I am trying a few idea's on the signature issue still. I also thought about taking the NAND flash off the circuit board, but I don't know if I want to spend the money to buy another APIM just to take it apart.
[Windows Mobile Development and Hacking General] super jay:
Hey all I just bought a 2013 Ford Fusion w/ MFT. Is it safe to update MFT or will that decrease the chance of this project working when it comes to be?
[Windows Mobile Development and Hacking General] seadiel:
Super Jay,

I am currently on version 3.7.11 (SYNCGen2_4.32.14122) the newest is one up 3.8 (SYNCGen2 V38 15128 updatepackage NA Rev1). I have not looked at the newest version 3.8 yet but I can confirm the update 3.7.11 released 2014 is

still

vulnerable to the Microsoft Security Vulnerability (MS13-098) Even though this security update was in 12/2013. / 7/2014

“The security update addresses the vulnerability by modifying how the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable files.”

I am able to successfully add additional code to the .999 file without affecting the digital signature. The problem is in order to add the data to the .999 file you have to unpack the .cab file so even though I can get the code in the .999 file and it remain a valid digital signature, I am struggling on repacking the .cab in order to get a valid signature now for the “Ford Motor Company Internal SYNCGEN2 Issuing CA”.

So I am working on just adding the extra code to the .cab file. I can add the code to the cab file without breaking the signature it is just more difficult to understand the .cab hex layout in terms of the format/headers/compression compared to a PE file.

Even if someone is able to get full access to the sync system doesn’t mean you can just drop an android image in, problem solved. The android image would require a lot of customization to make it all work. I am just looking to see if I can get in and if there is a simple way to activate navigation once in without having to modify the hardware/As built data. If successful then this would open up other possible areas like adding more functions or apps.
[Windows Mobile Development and Hacking General] super jay:
Thanks for the reply Seadiel,

I should have some free time tomorrow to work on this. I'll try and see if the latest update is still vulnerable. If there's a more productive way for me to help out please let me know.

Edit: Removed unnecessary quote
[Windows Mobile Development and Hacking General] akifyilmaz:
Following this thread...

I'm willing to buy navigation SD cards but Ford is not even giving me the option to open (purchase) Navi functionality!
[Windows Mobile Development and Hacking General] seadiel:
Just an update, I am still messing around with this on my free time. I have a few projects with this going on. I am still working on the added code to the cab file using the (Microsoft Security Vulnerability (MS13-098)). Takes a while to learn hex/COFF structures. I attached the PE file format structure & how it relates to the Authenticode signature format. Crazy you can still add a ton of extra code to a file without breaking a checksum/digital signature.

I been playing around with “BadUSB” that exploits the USB Phison PS2251-03 (2303) controller. I am still working on the firmware to tailor it towards windows ce/myfordtouch.

I will post the instructions soon on how to enable Navigation/backup camera via the hardware/CAN route, since the software side is more difficult.
[Windows Mobile Development and Hacking General] Dr3X:
I had the same situation. Bricked the NAV when installed the last SYNC update. I could see the license on the MFT but NAV was no longer functional. After some digging into the update files found a discrepancy and "crafted" one with the missing files. It worked like a champ. Now my NAV is working again. You can download it here:

------------https://onedrive.live.com/redir?resid=134D09ADEFC20FD3!52459&authkey=!AH57Dq9Jl3Fj71c&ithint=file%2czip

If the Full package does not work, PM. I will look for the one I used to load just the renaming NAV pieces. Also, need a master reset after the update.

Now I need to figure out how to enable the backup camera into this APIM. I lost mine when swapped for NAV.

GL
[Windows Mobile Development and Hacking General] MarcinXDA:
Backup camera could be enabled by obd2 cable (stn1170) and FoCCCus software.
[Windows Mobile Development and Hacking General] seadiel:
Dr3X,

Thanks for the files. I just noticed EA5T-14D544-AD.zip is not digital signed nor is the .sec file. I am assuming you used this and it worked? I will have to look at that .sec some more, I never really looked at it since it is a 2GB file uncompressed, but if the system will allow that file with no digital signature that is interesting.
[Windows Mobile Development and Hacking General] Dr3X:
Here is the NAV only pieces I used to fix mine. If you already have the same code level and try to install the full package it will stop because is the same level of code. But with a install file with only the missing pieces it will go thru. After the install is finished then do a master reset and you should have that APIM back to nav again.

-----------https://onedrive.live.com/redir?resid=134D09ADEFC20FD3!55786&authkey=!AMRvmLCVKv7eBUs&ithint=file%2czip

---------- Post added at 04:45 PM ---------- Previous post was at 04:39 PM ----------

Can you point me on the right direction to get them?

Thanks
[Windows Mobile Development and Hacking General] ptodic:
It seems that ZIP-s are signed too.
[Windows Mobile Development and Hacking General] seadiel:
When I right click the .zip files I don't see a digital signature tab, I also ran the zip files through sigcheck and it says it is unsigned. There is only one .zip file that does not contain a digital signed .CAB file in it. That is the .sec file found in EA5T-14D544-AD.zip or EA5T-14D544-AC*.zip (Depending on sync upload files/version you have)

Edit: I ran the .sec file through strings.exe looking at the Unicode text in the file and find it interesting as it talks about like there is a windows desktop there with internet explore, FTP, offline mode/this page is secure/you will be redirected ect ect. I attached a screen capture of a portion of the print out. The file is 2gb so I only printed about 10mb in a command console.
[Windows Mobile Development and Hacking General] MarcinXDA:
What car do you have?

I have ford focus mk3 and Focccus is good for it.

If you have other ford probably Forscan is for you. If you have focus mk3.5 or mondeo mk4 then probably only ucds cable is ok (from russia).

There is also IDS, but it is expensive.

You could find someone with proper cable and knowledge in your area.

I could help with Focccus as I use it.

---------- Post added at 08:59 PM ---------- Previous post was at 08:55 PM ----------

For Focccus you could also read this tread

http://www.focusfanatics.com/forum/showthread.php?p=5863970

---------- Post added at 09:13 PM ---------- Previous post was at 08:59 PM ----------

Enabling rear view camera in ford focus mk3:

Change BCM value

"99" "Park assist camera"

to option "02" With Park Assist Camera.

That's it.
[Windows Mobile Development and Hacking General] ptodic:
Please dont flood this thread with newbie questions, asking for video tutorials etc.. If you dont understand the information shared here ask some more experienced friend for help to understand the info provided. This thread is for finding out cool stuff and sharing research information/solutions from which all can benefit.
[Windows Mobile Development and Hacking General] trkkar:
Ok man i appologies and thank you :)
[Windows Mobile Development and Hacking General] phantomknight321:
Ok guys, just finished this on my '13 Focus ST2...ill go more into detail on how it went for me tomorrow, but I was very satisfied with how it all came together. Great work everyone who cracked this thing!!!
[Windows Mobile Development and Hacking General] TScott69:
Congratulations!

I have not been successful. I cannot get the download package to work (etis server throws an error) despite using all the proper data values obtained from my vehicles XML sync file. I checked all the numbers more than 5 times without success. The original download link in the xl file would download just fine. I left iswfpn alone as (EA5T-14F657-AD).

The only thing I can think of is it isn't working for anyone outside the U.S. (I live in Canada).

Has anyone outside the US got this to work?

I thought it was too good to true. :(
[Windows Mobile Development and Hacking General] COMpulse:
Don't give up. Use the values from the XML for everything except iswpfn. I struggled with those too. Get those from your Sync update autoinstall file. I'm still sketchy on how I got it downloaded, otherwise I would add more detail.
[Windows Mobile Development and Hacking General] ulao2:
If you get 500 errors, you typed in the data wrong. for example a vin missing one digit or letter. As for Canada you may need to change the installiswfpn. This is for the NAV is its region specific. I believe this info is in the update but I'm not cretin how to decipher that yet see below.

Hey guys, instead of stomping on the newbies why not contact the OP and have him post all of the needed info in the first post? No one really can go though all of this and it is always best to have everything in one place anyways.

can anyone explain from the update how to tell what name goes to what header?

Open1 = SyncMyRide\EA5T-14F657-AD.ZIP <-- pretty sure this one is installSWFPN

Open2 = SyncMyRide\BT4T-14F500-BE.CAB

Open3 = SyncMyRide\EA5T-14D546-AUA.CAB

Open4 = SyncMyRide\EA5T-14D546-AYD.ZIP

Open5 = SyncMyRide\EA5T-14D546-AVA.CAB
[Windows Mobile Development and Hacking General] sheltonfilms:
The way I see it is everyone spent so much time on figuring it out that if someone wants to do it they can take the time to go through the thread. You need to know the proof before you know the theorem.

There is no secret ingredient that is being left out.

The more simplistic this process is laid out the quicker something like this gets shut down. You are still relying on files from a server that can change at anytime.
[Windows Mobile Development and Hacking General] ulao2:
And I agree with that but for every person that has to go through all of this, we could be using that time better. Granted we need the OPs cooperation.

Think of it this way,

user5 asks a new'b question you tell him to read thru it all. He does.

user6 sees that and does not ask

Pages go by.

user7 does not see that comment, you just created the same issue we have with the needed info to be read (and now there is more to read thru). Fact of the matter is anything we post will roll over in a few hours. So by replying (and making posts like this one) we are contributing to the length of the topic and cluttering it up. So all for not.

There are two ways to communicate to the new'bs. Sigs and OP. The rest is hit and miss. Anyways back to the cause...
[Windows Mobile Development and Hacking General] phantomknight321:
OK, so it seems alot of people on this thread are becoming very protective over the process. I certainly agree that we should proceed with utmost caution as if this explodes, they will shut this down.

However, lets not forget that the entire point of this was to help everyone who wanted to get nav have access to it. I am going to be experimenting with the files and seeing if its possible to install the package on any vehicle, that way we dont have to rely on fords servers to get it. So far, it seems everyone needs the same install package, and the only discernible difference on the surface is simply the VIN that they name the file. Ill post back as I dig through everything, but I did notice that the navigation setup file is a .zip which is pretty interesting, you can browse through it and see all of the setup files involved.

I suppose now would be a good time to lead the discussion on towards reverse camera. This one may be more difficult to do, I am going to check on my car to see if the wires are already run by chance, it may be as easy as enabling bits in the APIM, though it may need software as well, which means a similar process will be needed to download the reverse camera files.
[Windows Mobile Development and Hacking General] flsdiver:
We need a new thread then...with relevant info, and with the purpose to answer these questions. That way this thread can continue it's intended purpose, like actual jailbreak, rearview camera, etc. I have more from my decompile i have found out i need to investigate too.

As for time spent by new people to get it working.....if you can't spend a few hours to read and learn and play, i guess you don't get the prize. This is not cookie cutter, one size fits all, learn about your about your software. That file i posted makes it about as easy as it can be. To me that's the fun of it anyway.

I have 300+ hours in this so far, to get it to this point, so I honestly have no sympathy whatsoever for b!tching from people that can't spend a few hours to get up to speed after being handed the sollution. Honestly, it's insulting.
[Windows Mobile Development and Hacking General] phantomknight321:
So in order to test the rearview camera, we probably need to have someone pick up the hardware first right? I am looking into ford OEM options for the camera itself, and later tonight I will take apart the rear and see if there is a wire there.

How can we figure out if there is another file the system would need installed for rear view? That way it has things like the guidance lines, etc, OR is that already present? Sorry, I am still settling into this and want to help but im still figuring out where I can start
[Windows Mobile Development and Hacking General] flsdiver:
Knowledge is key here, and actually already covered. The BT4T-14F500-BE.CAB you need for the license key for NAV is signed by ford for the ESN for your vehicle. VIN probably doesn't matter. If you can make a generic CAB, that you can sign that Sync will accept and load, let us know, because that would lead to a jailbreak of the whole software loading process. I know of no process publicly available that can break rsa 2048 bit signature in reasonable lifetimes.
[Windows Mobile Development and Hacking General] phantomknight321:
Thanks for clarifying this. I will try and play around with the files but doubt I will get anywhere in that case.

I can see this now, since when I hash the BT4T-14F500-BE.CAB from your package and compare it to the one in mine, the MD5 is pretty different between the two
[Windows Mobile Development and Hacking General] ulao2:
This tread is to help people, I say we keep it that way :)

I can enable NAV on any car simply bu programming the APIM from IDS and enabling the bits via my own tool. We are trying to get this all done via a stick. The problem we have is that once the stick is used its no good for the next car. So my guess is it fails because the 500 file is not a match. So My thinking is to use this url and make a new lic. file and replace it. Now that stick will work on any car we program if for. If you go in to the service menu on the radio you can get the APIM serial number. We know the VIN and nav file is always EA5T-14F657-AD (for us). The other data we should be able to get from the update. Though it's not clear to me just yet what I need. I do have a "sheet" here that tells me how to break down all of these part numbers. Like Bm5t the B mean 2013 if it was a 9 it would mean 2009. So I hope to get this parameters figure out without the site.

---------- Post added at 02:52 PM ---------- Previous post was at 02:44 PM ----------

rear cam is very easy, just turn on the right bit. The camera should already be there. If its not connect one....

You talk to the APIM via 7D0 and set the first byte ( bit 1 to on, bit 2 to off)

byte one 0x * 1 0 * * * * *

* means leave alone ( the way it was )

1 means on

0 mean off

or in other words flip bit 0x04 on the first D0 byte.
[Windows Mobile Development and Hacking General] phantomknight321:
What is interesting is that the contents of the .cab file all have an identical MD5. So, even though I know this has been discussed alot, the trick is in signing the .cab file. I am learning about this now, but we won't know how to do this without reverse engineering and breaking the .cab that they already signed. It is starting to sound like pursuing this method any further will be very difficult

Yeah I will have to dig back to when this bit was first mentioned. I found a rearview OEM style camera for $26 on ebay I plan to pick up and try out
[Windows Mobile Development and Hacking General] ulao2:
I almost have the numbers down here are the ones I'm not able to figure out.

cspn- I think this is the VIP (EM5T-14D205-AD in my case)

ccpn- left blank for NAV I think

rswfpn- no clue

uswfpn - no clue

known

VIN

emsn	-apim #

ecuhpn	-hardware part # of apim

cipn	-image to show on the boot up, I'm pretty sure.

vp- http://wikicars.org/en/List_of_Ford_platforms

iswfpn - the NAV file for your area.

timeout - 30000

I always get invalid or unsigned file, does this mean the parameters are incorrect, or is there more to this like driver signed md5?
[Windows Mobile Development and Hacking General] ulao2:
Ahh, ok I missed this part but I do not see this data?

Assuming that should be in the xml, but its not?

ok I just when by line 6 instead. And looks like the 500 file passed signing. Ill report back if nav lic. shows up.
[Windows Mobile Development and Hacking General] COMpulse:
That excerpt is from the .AB file.

The fields you need from the XML are:

[VIN]/[ESN]/[HardwareFordPartNumber]/[ImageFPN]/DEALER?cspn=[VMCUFordPartNumber]
[Windows Mobile Development and Hacking General] ulao2:
ok it works. Very nice. got my truck enabled.
[Windows Mobile Development and Hacking General] seadiel:
We are going to need a new thread on the jail breaking portion... Too many posts on how to's/problems. Can someone make flsdiver's posts sticky to the first page?

If we can look at the Microsoft publish certificate md5/1024rsa on the .999 files this may be a way to install other items. Hash clashing won't necessarily work since we need a secondary preimage attack on the md5, which from what I can tell not possible. I am still playing around with the 2GB image file for other idea's.
[Windows Mobile Development and Hacking General] coAlex:
¿Sabes cómo construir una Dll con los archivos de código que dejó STL1te?

Mod translation: Do you know how to build a Dll with the code files left by STL1te?
[Windows Mobile Development and Hacking General] sensorial:
El problema es sólo con la voz. Después de conectar el iPhone a través del adaptador Carlinkit2.0, hay una imagen pero no hay sonido. Pesar de conectarse a BT y seleccionar la tecla iphone en entretenimiento. Un problema adicional es que sync2 se bloquea al salir de applecarplay

Mod translation: The problem is only with the voice. After connecting the iPhone via Carlinkit2.0 adapter, there is a picture but no sound. Despite connect to BT and select iphone key in entertainment. An additional problem is that sync2 crashes when exiting applecarplay
[Windows Mobile Development and Hacking General] Badger50:
Greetings. As a friendly reminder, we ask all members to please post in English as stipulated by XDA Rule #4:

Spoiler content hidden.

Thank you for your cooperation, and have a pleasant day.

-Regards: Badger50
[Windows Mobile Development and Hacking General] coAlex:
if you can compile, you could adjust the syncappsruner so that the output of AutoKit is not traumatic, on the other hand I could not compile the dll, pars.assign it to autokit in the installation, however I managed, but I would like to be able to create a dll
[Windows Mobile Development and Hacking General] sensorial:
WE HAVE IT !!

Thanks to the help of colleagues from the group and international cooperation. We managed to work out a package for SYNC 2.

-Mirrorlink

-Mirrorlink + VideoPlayer

-Mirrorlink + VideoPlayer + Navitel

and

Mirrorlink for iPhone = AutoKit

-AutoKit

-AutoKit + VideoPlayer

Which allows you to get the AppeCarPlay or AndroidAuto options after connecting the iPhone, the condition is to buy the Carlinkit 2.0 adapter

https://allegro.pl/oferta/carlinkit-adapter-wired-do-apple-carplay-auto-12313880864

*************

The POLISH LECTOR navigation package was created for the POLISH community.

All files are coded to the serial number of the sync 2 radio.

Priv.
[Windows Mobile Development and Hacking General] vpanta:
Hi,

but AndroidAuto work with Android Phone ?

Thanks