yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] rafikok:
Hi. I am asking for a package with AutoKit (android) under serial number YU2801HN
[Windows Mobile Development and Hacking General] galuquetta:
How can I do that?
[Windows Mobile Development and Hacking General] sensorial:
Read it. Download the AutoKit.apk application to your phone and connect the Carlinkit adapter to your phone with the OTG adapter and update the adapter firmware, change the Bluetooth voice and resolution.

Post in thread 'MyFord Touch system hack. Enable features, navigation, rear view camera, etc.' https://xdaforums.com/t/myford-touc...on-rear-view-camera-etc.3321397/post-89233923
[Windows Mobile Development and Hacking General] rafikok:
Thanks. I have a problem with Easy Connect. The Play Store version EN 5.1 does not want to connect. The Chinese version connects. Do you have a proven version of Easy connect.apk, EN version? Tomorrow I will check it with another cable and another phone. Soft Sync2 3.10
[Windows Mobile Development and Hacking General] sensorial:
Very good stable EN version.

103.88 MB file on MEGA

mega.nz
[Windows Mobile Development and Hacking General] rafikok:
thanks, I'll check tomorrow. during installation, it offers updates to version 8.
[Windows Mobile Development and Hacking General] dakota583:
Hello,

Could you please help me to get files for install autokit.

I've installed mirrorlink before it's working with easyconnect but then I got a carlinkit adapter and if understand well I need another software on my sync installed.

Serial XV265F17

Thank you
[Windows Mobile Development and Hacking General] sensorial:
Please send me the file, you have 24 hours to upload it to the car. I sent the instructions in a private message.

File on MEGA

mega.nz
[Windows Mobile Development and Hacking General] Froz7:
Hi, is me again, thanks for the files, it works but i have a question.

how i can update navitel maps?, cause i´m searching the South America map.
[Windows Mobile Development and Hacking General] sensorial:
You need to search the Internet for the maps you are interested in for WinCE
[Windows Mobile Development and Hacking General] bobbenoster:
Anyone had luck using OpenStreetMap for navitel? They have a process to convert the maps for navitel...
[Windows Mobile Development and Hacking General] rafikok:
Help.

I bought CarlinKit Model CPC200-CCPM in a yellow paper box (white module). AutoKit connects but only Google Maps is displayed, touch does not work, no side menu.

I have USB debugging turned on, I checked it on several Android phones and it's the same on all of them. Module and application updated to version 2023.

If I have the module connected to Sync2, when I go to the application on the Smartphone, in the Detection tab there is an error with USB.
[Windows Mobile Development and Hacking General] sensorial:
update the adapter itself, I described how to do it a few posts above
[Windows Mobile Development and Hacking General] rafikok:
I updated the module immediately. maybe something needs to be changed in the autokit settingsthe box was updated. I don't know if this software from Vincent works on Android. What's also strange is that when I select AutoKit, Easy Connect starts first, there is a connection error because the box is connected, it gives me a back button only when I have a menu to choose whether to run Easy Connect or AutoKit.
[Windows Mobile Development and Hacking General] sensorial:
I think you have the wrong files, not from my package. I don't have such errors. send me the serial number, I will prepare my package for you, but I think you should reinstall the software to have a fresh version. 3.10
[Windows Mobile Development and Hacking General] rafikok:
Serial number: YU2801HN

Should I upload Soft 3.10 as before, or do I need to perform any other procedure?
[Windows Mobile Development and Hacking General] sensorial:
if you already have 3.10 in your car, you need to downgrade to 3.08 NA and then reinstall 3.10
[Windows Mobile Development and Hacking General] rafikok:
Ready. Generate file for me
[Windows Mobile Development and Hacking General] sensorial:
File on MEGA

mega.nz
[Windows Mobile Development and Hacking General] scaror:
Hi. I've been following this topic for a while now. It's so awesome you figured out how to make this Ford system more relevant again. Today I've received the Carlinkit adapter in the yellow box and made sure it's running on the latest version. My Ford Sync is also up to date (3.10).

Could you please generate the files for me (Android & iOS)? Serial YU6800P7. Thanks!
[Windows Mobile Development and Hacking General] sensorial:
File on MEGA

mega.nz

Remember that you have 24 hours to upload the file to the car. I sent you installation instructions in a private message.
[Windows Mobile Development and Hacking General] rafikok:
Thank you. unfortunately it didn't help. carlinkit connects but not completely. I can see Google Maps, but the touch does not work, there is no side menu. I guess carlinkit is damaged, although the phone shows that android auto is connected. Android 13.
[Windows Mobile Development and Hacking General] sensorial:
try changing the resolutions in the adapter, set the resolution to Auto, test it, but disconnect and reconnect each time
[Windows Mobile Development and Hacking General] rafikok:
I tried with no result. Can you take a photo of all your settings in the application? Smartfon samsung galaxy A32 , motorola g30, g70
[Windows Mobile Development and Hacking General] scaror:
I seem to have the same issue as rafikok: with the Carlinktit adapter and my phone connected to Sync 2, AutoKit uses only part of the screen (black bars on left and right side) to show Google Maps and touch screen is not working. See video:

Also, only part of the window is shown. After starting a route on the phone, the alert box with the remaining route time and distance is only partially visible at the bottom of the screen.

Tried different resolution options. Setting it to 480p had an interesting results: wider black bars on both sides, but now a menubar was visible at the bottom of the screen. That menubar was flickering though. Touch screen still not working. Tried another phone, but same result.

Ford Sync version: 3.10.16180.EA.0_PRODUCT

Carlinkit model: CPC200-CCPM (see back of yellow box)

Carlinkit box version: 2022.12.08.1636 (was already this version after purchase, no updates found)
[Windows Mobile Development and Hacking General] galuquetta:
This is exactly the same thing that happened to me.
[Windows Mobile Development and Hacking General] rafikok:
To update CarlinKit, you must have an OTG USB adapter.

######################

EasyConnected works

I will add that my Samsung smartphone has Android Auto version 10.9.634644. I connected it using three different cables.

and this is the view when the adapter is connected to Sync2 and the smartphone. Doesn't connect?
[Windows Mobile Development and Hacking General] scaror:
I see in the picture that you have a newer Box version than I have. Perhaps my adapter is not OTG. I've ordered one. Thanks for pointing out.

When I connect the box to my phone using the USB adapter, it changes the text from 'Please insert the product' to 'Please insert the phone'. When I connect a second phone with a cable to the box, it starts up Android Auto: the second phone is now controllable through an Android Auto window on the first phone.
[Windows Mobile Development and Hacking General] rafikok:
I understand correctly that you connected your smartphone 1 > carlinKit > smartphone 2 , and Android Auto works?

This would mean that the error is between CarlinKit and Sync2 communication.
[Windows Mobile Development and Hacking General] scaror:
Yes correct. This way smartphone 1 displays Android Auto of smartphone 2. Full screen and touch is working.
[Windows Mobile Development and Hacking General] scufita.rosie:
Hey everyone! Can 8 have the install file for sync serial number XV393FRF

Thank you so much!
[Windows Mobile Development and Hacking General] sensorial:
File for you. Remember that you only have 24 hours to upload the package to the car. I sent you instructions in a private message.

File on MEGA

mega.nz
[Windows Mobile Development and Hacking General] scufita.rosie:
Hey! Wondering if there's been any progress on this project and/or if there's a GitHub repository that we can check/ follow.

Thanks!
[Windows Mobile Development and Hacking General] scufita.rosie:
I'm also wondering if there's a place we can get maps for the navitel app?
[Windows Mobile Development and Hacking General] sensorial:
For everyone who is looking for maps for NAVITEL navigation. A very interesting site.

Navitel / Официальные карты релиза Q1 2023 v9 :: RuTracker.org

Navitel / Официальные карты релиза Q1 2023 v9 » Navigon / Navitel :: RuTracker.org

rutracker.org
[Windows Mobile Development and Hacking General] bobbenoster:
1pc Cpc200-ccpa Car Ai Box For Upgrading Your Car Screen With Wireless Carplay+wireless Android Auto, Compatible With After-market Android Car Stereos (android Version 4.4 Or Above)

I discovered amazing products on SHEIN.com, come check them out!

1pc Cpc200-ccpa Car Ai Box For Upgrading Your Car Screen With Wireless Carplay+wireless Android Auto, Compatible With After-market Android Car Stereos (android Version 4.4 Or Above)

api-shein.shein.com

Yes I know the box isn't yellow... But it seems to match the description of what others are using?
[Windows Mobile Development and Hacking General] sensorial:
white is also ok, it will connect wirelessly but only to the iPhone. and for AndroidAuto there is a cable.
[Windows Mobile Development and Hacking General] scaror:
edit: improved solution in the post after this one.

I have found a reasonable solution for my issues (vertical black bars on the side, only part of Android Auto showing and touch not working)!

I noticed the same exact same issues with the box connected to two phones and the host phone in landscape mode. Somehow after changing resolution related settings back and forward, the landscape mode suddenly worked fine on 2 phones (no black bars). After this I connected the box to Ford Sync and the black bars where also gone there. But Android Auto was still only partially showing and touch still did not work.

Depending on the value for 'Android Auto' (480P, 720P or 1080P), the host shows different layouts for Android Auto (eg app icons on the left or bottom). It was on 1080P, so I changed it to 720P, more of the Android Auto UI was now visible on Ford Sync, but it's not usable.

Setting it to 480P did the trick: now all of the Android Auto UI is visible and touch is working...sort of:

I have to touch the screen about 1 cm above the button I want to press.

There is about a second delay in touch screen and the UI animation is a bit laggy.

There are small black bars on the top and bottom now.

The app icons on the bottom are unstable, these sometimes disappear and appear.

After playing around, my theory is that the box is either in portrait or landscape mode. In portrait mode the black bars appear on both sides. This mode can't be changed in AutoKit on Ford Sync, but it can be changed by connecting two phones. I can't explain precisely how to do that, I just toyed with the setting, and disconnected & connected the second phone a few times while the AutoKit app on the host phone is already in landscape mode.

The end result has some shortcomings, but Sync 2 itself is also not that responsive. At least now I'm able to use navigation with live traffic and listen to music on my phone using the screen in my car. If I find improvements, I will share them here.
[Windows Mobile Development and Hacking General] scaror:
I've refined the above solution for the small screen & touch not working issue in Android Auto. The UI is now showing nicely in full screen and touch is working fine.

It stumbled upon rioachim's comment:

His first sentence is the key to all the issues some of us are having: the dongle will use the last set resolution and it will not adapt to the resolution of Ford Sync.

My issues were solved after connecting the dongle to an Android device with a resolution of 800x480 with AutoKit.apk in landscape mode. These are the steps to achieve that:

1. Get another Android device, make sure it runs on 800x480 and install AutoKit.apk. Modern devices have a much higher resolution, so you need to change it. It can be done with the apps mentioned in this thread. That did not work for me, but I used ADB for it. In order for the UI to be usable, I also set the density to 160.

It did not do this on my main phone, but I used an old Android phone for that.

2. Open AutoKit.apk on the device in landscape mode.

3. Connect the dongle (with OTG USB adapter) and wait until it says 'Please connect the phone' in the middle.

4. Change these settings:

Decoding Method: Hardware

Resultion: 800x480

Display Size: XS

Image Scale: Fullscreen

Sometimes settings are not stored properly on the dongle. The be more sure, disconnect the dongle and repeat steps 2 to 4.

5. With the dongle connected to the device in landscape mode, connect your main phone to the dongle. Android Auto now starts on the first device in landscape mode.

6. Disconnect everything and connect the dongle and main phone to Ford Sync. Now it should be in full screen and with touch working. If not, you might need to repeat step 2 to 5.

Don't forget to restore the original resolution (and density) of your other Android device.
[Windows Mobile Development and Hacking General] rafikok:
I'm currently away from home and I can't check, but there is probably a simpler solution to our problem. Today I came across a video describing how to change the resolution, I set it to 800x480, now the size in the options is 800x480.
[Windows Mobile Development and Hacking General] scaror:
That would make it a lot simpler indeed. Did you make those screenshots? What did you do to open de resolution selector? I tried many variations of pressing the circle in the center, but nothing happens.
[Windows Mobile Development and Hacking General] rafikok:
yes, these are my screenshots. you have to try this way: 1 second press, 1 second break, and so on 5-6 times
[Windows Mobile Development and Hacking General] scaror:
This does not seem to work in the AutoKit.apk downloaded from the QR code / link on the yellow package. But it does work in a newer AutoKit.apk version downloaded from the Carlinkit website. I don't know if that version is compatible with the dongle from the yellow box. But if it is, then this is probably the easiest way to set the resolution of the dongle to 800x480. I suspect you need to have AutoKit.apk in landscape mode and make sure the 800x480 resolution rectangle starts at 0,0 (top left), as in your last screenshot.
[Windows Mobile Development and Hacking General] rafikok:
I have no way to check at the moment. I left the carlinkit module at home.
[Windows Mobile Development and Hacking General] neth15:
Great progres guys! Is the black status bar in Android Auto still flickering after this, or did the problem disappear?
[Windows Mobile Development and Hacking General] scaror:
Unfortunately it's still flickering.
[Windows Mobile Development and Hacking General] ulao2:
Granted, and then Ford catches on? If they keep the URL up that is great.
[Windows Mobile Development and Hacking General] flsdiver:
True, and nothing can be done about that, unless we figure out an actual flaw in the system and gain control of the install process. That's the true goal here.
[Windows Mobile Development and Hacking General] ulao2:
na, its simple...

https://www.digicert.com/TimeTravel/math.htm

LOL I'll get right on that.

Yes, getting in to the OS would have its advantages.

Did we start a thread on that? I have info to add, I do have an APIM that has its debug data port open.
[Windows Mobile Development and Hacking General] seadiel:
I created a new thread for activating the navigation

(http://xdaforums.com/windows-mobile/general/myford-touch-navigation-activation-t3368080)

Please direct all navigation activation problems in the new thread and lets get this thread back on track looking for a way to "jailbreak" myfordtouch.

Ulao2,

Can you get anything out of the debug data port?

As already noted trying to jailbreak this device has been difficult due to the digital signatures required. I have been looking around at copies of Microsoft Platform builder to see if the Microsoft Test Publish Certificate happens to have the certificate already created as part of the software and includes the private key somewhere. Probably wont have it but worth looking around.

I also notice the big 2GB image file (EA5T-14D544-AD.zip) has a ton of certificates in the image file, I been looking at that as well.
[Windows Mobile Development and Hacking General] COMpulse:
I was pulling some files from ETIS and noticed this one. It has files for Safe Mode in it...

Just wanted to share in case it helps with something.
[Windows Mobile Development and Hacking General] Universe_ST:
MFT Navigation SD card copying

So did anyone succeed in copying SD cards?

Can someone make a file content screenshot of the SD card?
[Windows Mobile Development and Hacking General] flsdiver:
This thread is not the place for this discussion, i am sure others would like to know that, start a new thread for it please.
[Windows Mobile Development and Hacking General] Universe_ST:
I`d like to but the forum said

Anyway I have some algorithm. If someone has A7 SD we can cooperate and try to make a copy.
[Windows Mobile Development and Hacking General] sheltonfilms:
Ok forgive my ignorance of cab files and signing, my background is more hardware based.

flsdiver,

When you install a cab file "who" looks to make sure it's correct? Is it the software that's on the unit already, or is it part of a self installation process?

Gears turning in my head are saying look at the files that are downloaded for the full module replacement process (I remember you saying you saw another URL in the decompiled code).

I'm wondering if there is a chance that initial install files happen to be less secure. What does a new APIM (never installed on a vehicle) have preloaded?

Just some thoughts.
[Windows Mobile Development and Hacking General] flsdiver:
Every time you try to install something, everything is checked by the OS for valid signature. Valid, continue, otherwise corrupt/invalid signature message.

All files that are done through usb install process, no matter what they are, seem to be signed by the same certificate from f0rd.

There is one exception, the EA5T-14F497-AD contains .sec file which seems to be main restore file, but we don't know how to force load this file either. It comes with the update files, but is not installed. Safe mode? Provisioning mode? we don't yet know.
[Windows Mobile Development and Hacking General] seadiel:
Did you already decompile that large java app already or were you still working on it? If not can you PM the link to it and I will go through it some more with IDA.
[Windows Mobile Development and Hacking General] flsdiver:
Bit of confusion. Java i referred to was the etis app, i got the url from that, that i do have a complete decompile of, using iterative java decompiler.

i have not put ida pro to the .sec file yet at all, ida didn't recognize it either, that's as far as i got. btw, you can cut the last 3/4 of that file (all FF). which really makes me think that's a fixed 2gb image file of some sort. lots of address type strings in it. Making me think it's not the OS. Dll for nav? i have no real idea yet honestly.

there is an curious reference in java app to this:

FastDownloaderTestUI.this.dlInterface.startDownload("D:/ws/temp/TestProj/dll/SYNCIIMAX.SYNCII.SEC");

ws = web services.

I have no clue wtf that's all about.
[Windows Mobile Development and Hacking General] COMpulse:
Can I get the .sec file easily? Looking at (and programming for) file formats is something I do a lot of.

I was wondering if it's a secure-boot file. I'm more than happy to look at anything.

Edit: I got it. I scrolled up a few posts...

Edit 2: I got a different file, but no .sec in it.. Only 203 meg. Maybe it's time for me to make sure I'm on the latest version...

Edit 3: I got a .sec file from Sync update files. Also gonna try a Sync update tonight and see if nav survives.
[Windows Mobile Development and Hacking General] seadiel:
Ah I see. I will take a look at the .sec file again.

I am still working on the Microsoft Test Publish Cert researching MD5 weaknesses. Also was thinking about that NAV SD card, I actually haven't looked at the files on it. I am assuming when you click NAV on the screen it executes / grabs files on the sd card. Maybe we could exploit something in the sd card/files.

I know the sd card is unique and can't easily duplicated.

Edit: Should be the file in EA5T-14D544-AD.zip
[Windows Mobile Development and Hacking General] ulao2:
ill need some tools. From what I can tell it's just a phone like device. I have good experience with android but nothing for CE/windows. I tried installing active sync but win7 took a dump on that. There there was some built in tool win win7 that also didnt work. There must be some software that knows what a wince device is and able to communicate with it.

From what I know the ICP in the car tells the APIM port to open. To get this to work I believe we need to communicate with the ICP. I have been trying that for an unrelated reason and there is a seed/key gate. I was able to figure that out with the help from some ford friends. So if at some point we need to open this port ill have some intel on it.
[Windows Mobile Development and Hacking General] flsdiver:
Can you run ceregedit against it during all modes/connections.? Would like answer if active sync is available or not, if it is, cracking into it would be much easier.

I must admit, envious of bench setup and ability to play with sacrificial unit. May need to step up and setup bench.
[Windows Mobile Development and Hacking General] seadiel:
This was the first thing I tried and couldn't get any response. In windows 7 you have to use the Microsoft Mobile Device Center since active sync is for XP.

I couldn't figure out how to get the unit to turn on in a bench setup I would supply the proper pin's power and ground but just wouldn't boot up.
[Windows Mobile Development and Hacking General] wystewart:
There's two things I am pretty sure involved in getting it to turn-on. First the ACM gets both 12V power from the battery and also a separate 12V only when starting. Second pretty sure you need to send the unit a canbus message to turn it on. I believe that the BCM sends a status that will start-up the unit when the key is turned on.

Both the APIM and ACM always have power. It is the BCM or equivalent unit that tells them what the key status is and whether they should turn on or not. The BCM will also tell them to shutdown when load shedding is needed (battery too low or timer expires).

I think you need to capture both the BCM message as well asthe canbus message from the car when you press the power button on and off and then replay that to the unit. There's some canbus tools in another forum that can record message and playback. I can point you to them if they might be helpful.

I am planning a bench setup in the next few months, so I hope it can be done. I have the ACM, APIM just need GPSM, I don't want to put it in the vehicle right away.

I'm also hoping there's away in to hacking the software from the hardware side. The photos of an APIM circuit board I've seen, it doesn't look promising, but I have yet to crack open my own unit.
[Windows Mobile Development and Hacking General] seadiel:
I assumed it had to do with the canbus sending a message to have it turn on. When I supplied power to the APIM the screen would just flash and then go black.

If you want cheap APIM's with screens go here (https://www.lkqonline.com) and buy the Fusion APIM's (Fusion seemed to be the cheapest $125)