yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] seadiel:
Flsdriver,

The portion you see at the end of the signature block after the ESN section is the authenticode hash. It appears the ESN section is included in the authenticode hashing so obviously changing the ESN will make this hash fail. I am working now to recalculate the hash with the new ESN.

First I am attempting to calculate the authenticode hash as it stands with a current file using whatever ESN it has in the file to see if my hash calculation will match.

I doubt they made it this secure using a salt, who knows you may be right.

They simply added the ESN in the authenticated attributes so when it hashed each 14F500 file would have a different hash in the file so when the system checks the hash it fails if it is modified and or ESN do not match. Can you change the ESN on the device to match the file then change back after you install? That would be something to look at as well. I was going to also add an unauthenticated attribute and see if that would work.
[Windows Mobile Development and Hacking General] macky75:
Hi,

I`m from Poland and worked for quite some time on adding the Navigation. I basically stopped where you currently are:

- Change AB from 00 to 04 as described

- Got the license file but couldn't install it

My general assumption was, that the people offering the service all have access to OASIS which is the tricky part.

What about the BT4T-14D546-DA file called "only for service provisioning", are we sure that this couldn't help us? Problem is I could not find it anywhere. I guess we will have to find someone with OASIS to download via APIM reconfiguration.
[Windows Mobile Development and Hacking General] flsdiver:
I doubt we can change ESN, should be burned in write once onto the chip. I haven't found it, can look for it, but that would shock me if we could.

I am having a lot of trouble finding the hash method that would constitute those end bytes. If you have any info on the end hash used, please pass along.
[Windows Mobile Development and Hacking General] lucasb8888:
That's the same thoughts I have that OASIS is the key to this.

---------- Post added at 08:43 PM ---------- Previous post was at 08:34 PM ----------

Also it looks like jmr061 wasn't the one to figured this out, a ford tech did

http://www.shoforum.com/index.php?threads/navigation-for-cars-without-navigation.128944/
[Windows Mobile Development and Hacking General] sheltonfilms:
"The only way that I am aware to enable it in the APIM is to alter the VIN of the vehicle. "-jmr061

Also, ESN number shouldn't have to be changed is what I deduced from jmr061's website:

"Travel Link may need to be manually enabled by Sirius staff as they will indicate your ESN/VIN doesn't support Travel Link but it will work."

Sounds to me is you change the VIN and do a full dealer update/reprogramming using files for the spoofed VIN.
[Windows Mobile Development and Hacking General] macky75:
The APIM gets the VIN from the BCM. The ESN is not changeable, the VIN you can alter in the BCM - no problem. Than, he might perform a full flash using OASIS and done.
[Windows Mobile Development and Hacking General] sheltonfilms:
So it sounds like the big question is can the OASIS programming be emulated without OASIS?
[Windows Mobile Development and Hacking General] jmr061:
The ESN refers to the one in the ACM as that is where the Sirius receiver is located. Sirius has record of ESN versus VIN and if It had Travel Link access from the factory.
[Windows Mobile Development and Hacking General] BeciMester:
Here you go :)

Lads don't forget to report back on how it went please!
[Windows Mobile Development and Hacking General] COMpulse:
I love when these things come together. Tomorrow I will test modifying the SWF directly. If that works, I can make a small app to modify the JPG with a new APIM ID.
[Windows Mobile Development and Hacking General] azitoshi:
Thanks i will report back in 2 hours.

---------- Post added at 07:13 AM ---------- Previous post was at 06:22 AM ----------

I have checked my apim id and its XTCGBXNG please correct my install.jpg, sorry i took my apim id from old picture when i was working on navi activation and that wasnt mine :)

Actually i have tried to modify install.jpg with my apim id by myslef and i think i did it right but of course it doesnt work :), can u check my file ?

https://1drv.ms/u/s!AlOwzdjzUlkMhJYcQCTJI-0nXcgXRw
[Windows Mobile Development and Hacking General] mauasca:
Please send me installer. Jpg

Serial

XV1MC9K3
[Windows Mobile Development and Hacking General] BeciMester:
Fixed file attached. You had most of them right but 3 were off; when you have your numbers in order, multiply those at the odd numbered locations by 2, and the even numbered locations by 3. So, multiply the first number by 2, the second by 3, third by 2 again, fourth by 3 again, and so on. Use this JSfiddle to check if you got your numbers right. Hope this helps.
[Windows Mobile Development and Hacking General] azitoshi:
OK thanks now i understand i go and check it will let u know whats going on :). Have you tried replacing install.bin from the zip i have posted early ? it has easyconnect in file name so i think it should be it.
[Windows Mobile Development and Hacking General] drego85:
I think the de-obfuscate ActionScript code is:

if([Plugins][DataManager][getValue](OutboundDIDs.APIMSerial) == XXAPIMSerialXX)
{
var _loc24_ = [Plugins,FileBrowser,FileBrowserPlugin][FBCopyFile](/USB Disk/SyncExtPack/UpdateInstaller.dll,/windows/UpdateInstaller.dll);
var _loc25_ = [Plugins,NativeApplet](UpdateInstaller);
}
[Windows Mobile Development and Hacking General] COMpulse:
I still don't understand why my original change to completely remove the comparison didn't work. Maybe I should have made it 'IF 1 == 1' or some guaranteed true comparison.

I'm now testing modifying the decompressed JPG directly to change the bytes for the APIM ID.

Edit: I guess if we have the whole thing decyphered there may soon be no need to modify the existing JPG.
[Windows Mobile Development and Hacking General] rioachim:
you have to appreciate the irony: you hacked Ford's work and now your files get hacked

[MENTION=3694909]COMpulse[/MENTION], you can always do "!=" instead of "==" in the if statement if available in hex code; I am just finding the time to have a look at it

update: damn, can't find the initial unmodified JPG, is the offset base in dec or in hex, and is it in jpg or swf file? plus UpdateInstaller.dll seems to be a custom dll, is there a check inside it too?
[Windows Mobile Development and Hacking General] orlandson:
Just tried. First part (JPG) works fine now. But the second part, after rename de pack_install won't work.

---------- Post added at 09:00 AM ---------- Previous post was at 08:57 AM ----------

I tried it. Also won't install.
[Windows Mobile Development and Hacking General] azitoshi:
I have tried that file which you fixed for me and guess what ? :) it did nothing not even reboot of sync2. I have double check apim id and its ok for sure dont know whats going on ?
[Windows Mobile Development and Hacking General] Pepsi1:
can someone plase verify these install files? I created an excel file that automatically replaces the numbers accordingly to the serial nr.

If they are modified correctly, i will post the excel. Thank you

the files were saves as .swf and then renamed as .jpg.
[Windows Mobile Development and Hacking General] drego85:
Did you create a new swf/jpg file, or did you use the JPEXS editor?

The JPEXS editor is experimental, it could give problems.
[Windows Mobile Development and Hacking General] azitoshi:
Pepsi1, both are ok, do they work for you - sync2 reboot ?
[Windows Mobile Development and Hacking General] Pepsi1:
i opened the installer.jpg file with FFdec and modified the numbers and then saved it as installer.swf. After that i changed the file extension to .jpg. I don't know if this is the correct thing to do or if I modified the serial nr. correctly.

I haven't tested them. I made the files for other friends cars. i'm not near my car right now.
[Windows Mobile Development and Hacking General] COMpulse:
I used JPEXS to edit the existing code by commenting out the IF and the brackets around the conditional code.. I was concerned about JPEXS possibly corrupting some part of the code.

That's why my new test is modifying the SWF directly. I wrote an app to modify the JPG bytes. Waiting for feedback from 2 potential testers. If it works I will post it.
[Windows Mobile Development and Hacking General] azitoshi:
Is this possible that my apim ID is different than it is shown in diagnostic menu ? for example someone changed something during navi activation ? I cant figure why this modified installer wont reboot my sync2 looks like code is not executed...
[Windows Mobile Development and Hacking General] Pepsi1:
I attached the excel I used to replace the serial nr.

How can we modify the .bin files to see what's inside or why doesn't the install begin?
[Windows Mobile Development and Hacking General] Pepsi1:
I attached the excel I created to change the apim serial nr in the code.

Now why doesn't the install begin?

How can we open the .bin files to see what's inside?
[Windows Mobile Development and Hacking General] rioachim:
opening Windows CE .bin files should be possible with: https://xdaforums.com/showthread.php?t=656086

unfortunately the .bin file format is not recognized
[Windows Mobile Development and Hacking General] drego85:
OK, perfect! If you want to start from scratch I posted the decoding function some message ago. It's very simple.

I do not understand where to get the .bin files for installing MirrorLink or Navitel. I want to study how he creates them, so we can try to write other applications.

Currently it works like this:

1. Installer.jpg is an "exploit" that loads UpdateInstaller.dll as system DDL

2. UpdateInstaller.dll probably starts installing the install.bin
[Windows Mobile Development and Hacking General] Pepsi1:
I've sent you a PM with a download link for NaviTel files. I don't have the files for MirrorLink.

So if installer.jpg is made correctly to the apim serial nr, why doesn't the installation begin? What are we missing?

beside azitoshi who tried to install the app but he doesn't know his exact serial nr, has anybody else tried to install the files?
[Windows Mobile Development and Hacking General] drego85:
I have no idea :) I have not tried on my Sync! I do not care about installing MirrorLink or Navitel! I want to understand how the system works, then I play it developing myself.

Yes, I know what the origin of the files is that...I requested it in the Italian forum! :) same username!
[Windows Mobile Development and Hacking General] orlandson:
MirrorLink install.bin was posted here few days ago.

View attachment SyncExtPack_YU5V01LR_MirrorLinkNew.zip
[Windows Mobile Development and Hacking General] wayneace8888:
I've tried this and the install.jpg does exactly what is supposed to do with regards to rebooting the system but the second part of the install after renaming the Pack_install.bin to just install.bin nothing happens. Tried the .jpg with navitel and mirror link and neither work past that point unfortunately. I'm willing to test any developments made by you guys.
[Windows Mobile Development and Hacking General] COMpulse:
Sounds like my JPG modifier works with the navitel JPG (so far).

We just need to better understand the install procedure.

Has anyone compared the JPG in the navitel zip with the MirrorLink JPG?
[Windows Mobile Development and Hacking General] azitoshi:
unfortunately mirrorlink zip doesnt contain jpg installer ;/
[Windows Mobile Development and Hacking General] wayneace8888:
Yes it does
[Windows Mobile Development and Hacking General] COMpulse:
Maybe the on you have doesn't... ;-D
[Windows Mobile Development and Hacking General] azitoshi:
I mean in mirrorlink zip i have posted earlier.... there is only install.bin inside.
[Windows Mobile Development and Hacking General] COMpulse:
I believe I have complete ZIPs of both.

Currently awaiting feedback testing modified JPG from MirrorLink ZIP.'
[Windows Mobile Development and Hacking General] wayneace8888:
You definitely have complete mirrorlink from me
[Windows Mobile Development and Hacking General] COMpulse:
I'm anxious to hear how the MirrorLink JPG i sent you works out.
[Windows Mobile Development and Hacking General] Mojaldo:
I don't know if this helps, but I was told to ensure that the installation is "carried out in an open area with access to satellites".
[Windows Mobile Development and Hacking General] wayneace8888:
I did reply on pm here and email saying the .jpg worked but the second part of the install didn't. I'll try your new one

---------- Post added at 05:49 PM ---------- Previous post was at 05:48 PM ----------

I was outside mate, still not working
[Windows Mobile Development and Hacking General] COMpulse:
At this point I have positive confirmation from two users ([MENTION=4207886]wayneace8888[/MENTION] and [MENTION=4207886]azitoshi[/MENTION]) that my program for modifying the bytes of the SWF (decompressed JPG) works to change the hard-coded APIM ID.

Both users indicate the Navitel process just reboots and performs maintenance. No success on step 2. Same as SWF modified through JPEXS.

Since I am not modifying the SWF with JPEXS, that rules out the possibility of JPEXS corrupting anything (at least in my tests).

Also I just learned how to tag users on this forum.
[Windows Mobile Development and Hacking General] orlandson:
Same here.
[Windows Mobile Development and Hacking General] drego85:
Ok, so there could be a check in the next steps. On Monday I start to decompile the DLL (which I think serves to start the installation).
[Windows Mobile Development and Hacking General] COMpulse:
UpdateInstaller.DLL appears to be the same for all packages. So I don't think there's anything helpful in there.

As for the BIN files, they are not Windows CE .bin files. My first guess is ARM pcode for some reason.

I suppose the next helpful thing would be to have two different sets of BIN files for the same package (just different APIM IDs) to compare BIN files.
[Windows Mobile Development and Hacking General] BeciMester:
Just a thought: instead of pouring resources into reversing how this particular process works... it apparently copies a file (UpdateInstaller.dll) to the Sync and executes it. So if we think of it this way... are we able to run arbitrary code on the Sync now? Maybe it would be a better direction to move into? ;)
[Windows Mobile Development and Hacking General] wayneace8888:
To do what? More apps etc but our own way
[Windows Mobile Development and Hacking General] hugomtiggemann:
hello guys

I did change the installer.jpg by ffdec, it ran as it should.

but the install.bin file did not run ... I read in the Italian forum that the installation time is stipulated by Russo in 3 days, after this period one must ask for new files. will this control be in the DLL or BIN ???
[Windows Mobile Development and Hacking General] Xcorpia07:
good morning everyone. I've been following this topic of mirrorlink in sync2 of the Russians for quite some time. Thanks for sharing the files. I will try when I get home to continue deciphering the subject a bit more.

As already commented here, the jpg is an xploit for launcher.

What I would like to know is because in the instructions of the Russian, he insists that first the xploit of the jpg be made and then after that is when the usb is removed to modify the name of the pack_install to install.

Follow if you are all very great people to share.

P.D: sorry my poor English is from translator xD

P.D2 : In the italian forum :

"

I just installed the MirrorLink ...

I wanted to thank those who did the guide in Italian, although I had some problems that I solved talking directly to WhatsApp ...

Since my signature, I installed moddata 3.10.

of the guide, in the second step, where you only have to change the name of the installation file, it is not said that before re-inserting the pendrive you have to delete everything except the renamed file, otherwise, the procedure is not successful , that is, when the Sync restarts do not start the procedure to copy the codes to download them easily ... and it is not installed ... I did it as Pavel told me and now everything is fine ... Fortunately ... Moments of panic ...

PScome phone I have a Samsung S8 +""
[Windows Mobile Development and Hacking General] COMpulse:
So we wait for someone with a modified JPG to try these steps...
[Windows Mobile Development and Hacking General] azitoshi:
I walk through that procedure and it didnt work i did delete all files remaining only install.bin in SyncExtPack directory but nothing happend.
[Windows Mobile Development and Hacking General] Xcorpia07:
In the Italian forum, someone commented that the files had an expiration date, that if in 3 days it was not installed, they would have to request the files again.

So I'm thinking that maybe he also checks the date of the files. When they have been generated.

As far as I could understand, maybe it's not like that, it's that the jpg launches the updateinstaller, and this executes the update.bin that I think is a modified update of the original update. And this takes care once the sync is restarted it is in wait mode to find the install.bin. That's why I understand that you have to rename it after launching the jpg.

COMPULSO if you want I can also test my vehicle if you want.
[Windows Mobile Development and Hacking General] COMpulse:
Just some thoughts..

"moddata 3.10" ?

I would also consider using two separate USB drives, rather than modifying the same one mid-install, just to make things easier/faster. Have one with install.bin ready to rock and roll. But that might just be adding another variable and deviating from the instructions.

Feedback from one of my tests indicated that it did make the Sync system reboot in maintenance mode

twice

. However, it remains unclear if that was a good thing or a bad thing.
[Windows Mobile Development and Hacking General] azitoshi:
I rather think it is bad thing, becuase in installation manual there is screenshot with Ford logo (in step when sync2 is to reboot) this logo normally show up when you turn on sync2. In my case i didnt have this logo showing up after "reboot" there is only this schelded maintenance mode and after that immadietly sync2 home screen appears. But in other hand i think that we know already everything about installer.jpg exploit do we ?, it doesnt look complicated and the code is rather straithforward to push UpdateInstaller.dll to sync2.
[Windows Mobile Development and Hacking General] hugomtiggemann:
I tested the modified jpg file and everything occurred normally, but install.bin does not run. It does not work at all. Does the install.bin or update.bin file have expiration dates? the SYNC2(MFT) does not let change the date, it is made by GPS.
[Windows Mobile Development and Hacking General] azitoshi:
What does normally mean to you? Have you seen Ford logo during reboot ?
[Windows Mobile Development and Hacking General] orlandson:
First time I tried logo appears. Second time no more logo, but system rebooted normally. Maibe took a bit more time to reboot.
[Windows Mobile Development and Hacking General] hugomtiggemann:
"system maintenance" appears, it usually shuts down and restarts.

[IMG="Systemd maintenance"]https://drive.google.com/file/d/1FanvMdCOmk96_GRFXgaG2Uw5soomX9Ew/view?usp=sharing[/IMG]

---------- Post added at 06:46 PM ---------- Previous post was at 06:45 PM ----------

Image

https://drive.google.com/file/d/1FanvMdCOmk96_GRFXgaG2Uw5soomX9Ew/view?usp=sharing

---------- Post added at 06:46 PM ---------- Previous post was at 06:46 PM ----------

Image

https://drive.google.com/file/d/1FanvMdCOmk96_GRFXgaG2Uw5soomX9Ew/view?usp=sharing
[Windows Mobile Development and Hacking General] jmbach:
Perhaps we need to “unpack” the file pack_install.bin rather than just renaming/copying it.
[Windows Mobile Development and Hacking General] COMpulse:
Totally agree that may be the case, but it's not any standard archive format that I can identify. No ascii strings, no consistent header or magic number.

It might also be interesting to try using this to load a known good executable or pakckage for this OS. I don't know enough about how the sync interface and the underlying OS interact. And I don't have a sync system to play with.
[Windows Mobile Development and Hacking General] jmbach:
I only have the pack_install.bin file to look at. According to the documentation I can find on Microsoft pages, it does not have the header for a windows CE bin file. Wonder if the update.bin file has the appropriate header.
[Windows Mobile Development and Hacking General] BeciMester:
Guys, I think this whole solution is custom built, with obfuscation and who-knows-what else, to prevent exactly what we're trying to do here. Even if we somehow managed to decipher the pack_install.bin, it's just the Navitel app with some kind of custom compression/encryption, similarly the update.bin is probably just a custom loader for the install.bin. This is not very interesting.

What's a lot more interesting to me is the fact that apparently, the ActionScript code in the modded JPG can trigger an update process in the Sync... and it provides the name of the file to run (in this case, UpdateInstaller.dll). I'm now trying to find out if the UpdateInstaller.dll is required by the Sync to be present, or any program will do, as long as the filename is provided in the JPG. If it turns out that the UpdateInstaller.dll is indeed required (I'd say it's unlikely), only then I will look into how it works.
[Windows Mobile Development and Hacking General] Xcorpia07:
I believe that the updateinstaller.bin if required, because otherwise I'm wrong is a signed dll, which allows the execution of other files.

But I am not clear about the exact function of the jpg. we know or intuit that it is the exploit, but what I have been able to see with the ffdec, I do not understand it very well, since there are many variables and operations. How have you come to the conclusion that loc14 is the apim id of the vehicle? what are the rest of variable loc ???
[Windows Mobile Development and Hacking General] BeciMester:
The JPG is not a JPG, it's a SWF file (Flash). :) It's only named with a JPG extension so that the car is willing to consider loading it as a background image. (By the way, PNG Thankfully once it's loaded, the car doesn't check whether it's a real image file or not (major props to the fella who figured it out!), so once it's loaded into the Flash interface the car is running on, it gets executed as a Flash file.

The APIM of the Sync is not loc14, it's loc21 if you are decompiling the original file. See this post and this post for more details on the numbers.

BTW: Can someone who knows ActionScript clean up that code please? I'm not sure where the dot notation ends and whether we need any quotes/brackets etc.
[Windows Mobile Development and Hacking General] Xcorpia07:
if I already know that, but when renaming the jpg to .swf and opening it with the ffdec, there are many loc variables. and I would like to know how it was concluded that the variable loc_14 is the apim id. and what the rest of the variables mean.
[Windows Mobile Development and Hacking General] azitoshi:
its all explained in this post https://xdaforums.com/showpost.php?p=78036930&postcount=973
[Windows Mobile Development and Hacking General] santixlp:
Hi friends, link dont work, send me please updateinstaller.dll and update.bin if you have. thanks
[Windows Mobile Development and Hacking General] performanceisland:
2013 ford escape enable backup camera

guys i need help enabling backup camera on sync 2 as built data on a 2013 ford escape which did not have the feature before, i'm adding a camera, and is there a different option for with and without guidelines? thanks. please let me know what line and block to change in the as built data, greatly appreciate the help.
[Windows Mobile Development and Hacking General] haygun:
[MENTION=3694909]COMpulse[/MENTION] and [MENTION=2770105]BeciMester[/MENTION] thanks. With your help and solution, this mirrorlink sync2 will also work.