yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Development and Hacking General] flsdiver:
From your picture it looks like forscan did not identify all the modules on the truck? OBDII elm327 without HS/MS CAN switch? If that is not the case, there is a beta forscan that they worked with me on to identify the HS/MS Can properly on elm327. That should give you all modules on the 3 can buses. Thus allow access to ACM. Guess i should fire up the latest version and see what's up there.
[Windows Mobile Development and Hacking General] faucirt:
'Zackly. No (physical) switch on the elm327. 15 dollar ebay special. I still have to see whats on the driver CD that came with it, but I'm guessing its nothing that would help me.

Shoulda coughed up the cash for a good one. Hard lesson learned.

Already found the mods I need to make on the cable.... woohoo!
[Windows Mobile Development and Hacking General] flsdiver:
Virus ware!
[Windows Mobile Development and Hacking General] seadiel:
I noticed the JTAG pins as well. I have not yet attempted to dump the flash memory but that was going to be one place I want to try.

Hard to say if it would yield any useful information but I plan to do that one day. My goal is the same as yours.

Time permitting I am still working on the following:

Looking at the web link fisdiver found and seeing if there is any more use out of it.

Researching the platform builder sdk's maybe there are "test" certificates already created and they added to the build. If you look at that 2gb image file there are 30+ certificates it appears in the certificate store.

Want to look into the Nav SD card, maybe there is a way to exploit something on the sd card to gain access?

Looking at the Microsoft Test Publish Cert (MD5) exploit (unlikely)

Still want a universal nav unlocker tool as that link won't work forever
[Windows Mobile Development and Hacking General] wystewart:
The JTAG pins unfortunately are not accessible directly on the processor since it is a BGA. Also the MX516 processor has fuses that ford could have blown that lock out the JTAG interface anyway.

Theoretically., the flash chip could be unsoldered, then resoldered on to an SDHC card, then read in a card reader, assuming Win CE uses a standard file system such as FAT32 or NTFS. Most likely there would be some corruption on reading since it is likely that the APIM manages flash bad blocks differently than an SDHC card controller.
[Windows Mobile Development and Hacking General] faucirt:
Just wanted to update. Threw a DPDT switch onto my elm327 cable, and it read all of the modules. Just finished the ACM bit. Thanks!
[Windows Mobile Development and Hacking General] ulao2:
Yeah we created our own module that sends the wake up commands, you can also look for a cracked version of vspy and it will do nicely.

Tried to connect with ceregedit, it says check your active sync connections. I do see a WEA device under windows CE devices in DM.
[Windows Mobile Development and Hacking General] asmblur:
willing and able, need help getting started

Does anyone have access to the Sync Platform SDK? I've been trying to locate it myself but I'm not even positive what Windows version it's based on. My Gen 2 says "MS Auto 4.2 Zephyr" but it seems odd that they'd be using an OS that's no longer supported. I'm an embedded software engineer with many years of experience doing heavy reverse-engineering and would love to get code running on the APIM. Ultimately I'd like to replace the OS with embedded Linux, maybe with dual-boot support to retain the ability to boot into Sync. I've also got a full "rework" station and have a pretty good background in hardware modding but I'm not an EE. De-/re-populating ICs, read/write contents(in some cases), and logging various busses are all within my reach. However, I'm most useful for software/RE. I'm fairly new to ARM but learning quickly since it just so happens that we're starting on ARM projects at my place of employment now and Java is well-known to me. CE is very new to me, any relevant info/tools/etc would be greatly appreciated.

If you have anything that could help, or need help with something regarding this project, please contact me. I'm pissed off at buying a new 2016 Fusion that will probably never have a decent official OS and I hate not being able to run my own stuff. Their half-assed AppLink thing just ain't gonna do it.
[Windows Mobile Development and Hacking General] flsdiver:
Found a restore webservice that downloads vehicle info and the software list/links for 7d0 :cool:

Very interesting, this entry, and the software that came with it.

<software xsi:type="assemblySoftware">
<id>EM5T-14D205-AD</id>
<type>STRATEGY</type>
<didValue>61832</didValue>
<flashSequence>0</flashSequence>
<current>true</current>
<url>redacted</url>
<supportingSoftware xsi:type="assemblySoftware">
<id>BT4T-14D207-BA</id>
<type>SECONDARY_BOOTLOADER</type>
<didValue>0</didValue>
<current>false</current>
<url>redacted</url>
<uninstallable>false</uninstallable>
<nodeAddress>2000</nodeAddress>
</supportingSoftware>
<softwareSize>608927</softwareSize>
<binaryFileROMSize>608927</binaryFileROMSize>
<uninstallable>false</uninstallable>
<nodeAddress>2000</nodeAddress>
</software>

Secondary bootloader?

Attached is files from those urls.

Don't remember .vbf files from anything i have seen so far, maybe this has been covered.

Quick glance, looks like description header, checksum then image.

Need to strip the top stuff and put to ida?

section after that gives the .sec file we already have seen.

<software xsi:type="assemblySoftware">
<id>EA5T-14D544-AD</id>
<type>IMAGE</type>
<didValue>32819</didValue>
<flashSequence>1</flashSequence>
<current>true</current>
<url>redacted</url>
<version>SYNC2 - V3.8</version>
<softwareSize>348736685</softwareSize>
<binaryFileROMSize>348736685</binaryFileROMSize>
<runtimeSize>2104594700</runtimeSize>
[Windows Mobile Development and Hacking General] COMpulse:
My initial searching leads me to Volvo Binary File format. And I think Ford / Mazda / Volvo vehicles share certain equipment in common.
[Windows Mobile Development and Hacking General] ptodic:
Yes you are both right. VBF is the format used to program Ford cars after year 2006 (at least here in Europe). It has been "borrowed" from Volvo when Ford acquired them. Usually there is always a bootloader (BT4T-14D207-BA.VBF in this case) which defines the speed (MS CAN or HS CAN) and address of the module. It is usually followed by mcu firmware and then eeprom. I dont know what is the purpose of EM5T-14D205-AD.VBF at this moment...
[Windows Mobile Development and Hacking General] seadiel:
Interesting find, I will take a look through it tomorrow.

I didn't know that about Volvo.
[Windows Mobile Development and Hacking General] wystewart:
Could you by chance share the canbus message data that would wake up the APIM/ACM? Or perhaps the module? it would be much appreciated, I don't have access to a sync2 vehicle at the moment to record the traffic so knowing the messages would get me one step closer to a bench setup for doing some hacking.
[Windows Mobile Development and Hacking General] asmblur:
Some VBF info:

checksum is a simple crc32 of the "binary" portion of the file which follows the header(see "BINARY_STARTS_HERE")

Excerpt:

vbf_version = 2.4;

header {

....

//file checksum

file_checksum = 0xa3ef7f1a;

}BINARY_STARTS_HERE
[Windows Mobile Development and Hacking General] rioachim:
VBF files are software updates or firmware for car modules. Most of them are accesible from following link with software part number + zip extension:

https://www.fordtechservice.dealerc...Reprogram/DSFM_PCMReprogram.asp?swproduct=IDS

I would say in APIM's case, this file will be used for VIP programming, while navigation resides in CIP as mentioned previously
[Windows Mobile Development and Hacking General] Hickrm:
@sensorial I have changed the name to install and it doesn't not start the installer screen even after an hour
[Windows Mobile Development and Hacking General] sensorial:
take another pen drive. do a master reset of the unit
[Windows Mobile Development and Hacking General] Hickrm:
Still not able to get this to work @sensorial so I will downgrade to 3.8 and then to 3.10 and try again with the files you sent on Friday
[Windows Mobile Development and Hacking General] sensorial:
downgrade to 3.08, then upload 3.10 and let me know, I'll make a fresh new file for you
[Windows Mobile Development and Hacking General] Hickrm:
Any chance you could do me a new file please I have downgraded and upgraded to 3.10 and it still isn't working 😔
[Windows Mobile Development and Hacking General] sensorial:
send the serial number
[Windows Mobile Development and Hacking General] Hickrm:
Serial number XTCDWPWF

Thank you
[Windows Mobile Development and Hacking General] Hickrm:
Did you manage to sort this as I haven't yet
[Windows Mobile Development and Hacking General] sensorial:
Please.

137.73 MB file on MEGA

mega.nz
[Windows Mobile Development and Hacking General] Hickrm:
Amazing it installed this time, thank you for your help
[Windows Mobile Development and Hacking General] Hickrm:
Can anyone help with the autokit app that will let you change the resolution to 800*406 as I have the Samsung fold 5 so android auto does not display correctly or let me click in the correct place on the sync screen
[Windows Mobile Development and Hacking General] sensorial:
DPI Changer & Checker For Game - Apps on Google Play

DPI Changer & Checker for games - Display fps & resolution repair for screen

play.google.com
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Have you managed to get the package worked and connect successfully

If yes, can you please tell me how??
[Windows Mobile Development and Hacking General] cabirnator:
Hi!

Please make me a pkg with autokit, mirrorlink, navitel, total commander and videoplayer. SN XT7088QJ.

And and tell me what application is needed for android 9?

Thanks!
[Windows Mobile Development and Hacking General] Hickrm:
I have so I had to do it the long way round. But I downloaded autokit on to an android tablet and that gave me the correct screen resolution. Now I just have the map section on the sync screen going from half screen to full every couple of seconds
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
It is not working for me, it keep saying connecting and nothing happened.

Did you do any special steps
[Windows Mobile Development and Hacking General] Hickrm:
Any idea how to stop this?
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
How you got this work, any instruction or any ideas
[Windows Mobile Development and Hacking General] Hickrm:
I followed what a member put a while back (sorry can't remember the page)

1. Put the dongle into a android tablet (could use older phone as well)

2. Installed the autokit software on the tablet that @sensorial posted

3. Made sure that the tablet was in landscape and opened autokit

4. Selected the resolution 800x400, selected xs in the size, changed to Bluetooth setting in advanced setting.

5. Plugged my phone into the usb on the dongle. Whilst connected to the tablet!! This was to check the settings and layout etc.

6. Unplug the dongle and put it in the car.

Two things to note though:

I have the flickering I posted in the video above

I don't have autokit installed on my phone the plugs in the car

I don't know if autokit is meant to be on my phone as well?? (Or is this just used for settings)

If someone can answer if it is actually meant to be on my phone that connects to the car and help with my video above that would be great!

Sorry for the long post but trying to help as best I can
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Hello @sensorial , @Hickrm , All

anyone able to get the mirror link works for the android 14, i keep getting that the below issue, is there any app should be installed over my device.

my device is :MI 11T with android14
[Windows Mobile Development and Hacking General] Hickrm:
Use this link that sensorial provided. (Page 138, post 2749 incase the link doesn't work)
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Did the mirroring work for you??
[Windows Mobile Development and Hacking General] Hickrm:
It did so you install the app then I did not need to use the QR code on the sync screen
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
It did not work for me, i have installed the app and open the usb debug mode

And connect the cable and get the screen for the code to install the app

Did i miss anything??
[Windows Mobile Development and Hacking General] sensorial:
All versions for Android systems.

Android 13

103.88 MB file on MEGA

mega.nz

Android 14

129.47 MB file on MEGA

mega.nz

or

40.44 MB file on MEGA

mega.nz
[Windows Mobile Development and Hacking General] Hickrm:
@sensorial do you know how to stop the flickering across the top two apps as it then means I can't press the icons at the bottom?

And do I need the autokit app on the phone connected to the car or just for set up of the dongle?
[Windows Mobile Development and Hacking General] sensorial:
For users of an Android phone and the CARLINKIT box adapter who have resolution problems, an update and change of resolution settings is required.

You need to connect the OTG adapter to the phone's charging port and plug the CARLINKIT adapter into it.

Install the AutoKit application and change the parameters.

AutoKit

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

application to change the resolution of the Android Auto application

DPI Changer & Checker For Game - Apps on Google Play

DPI Changer & Checker for games - Display fps & resolution repair for screen

play.google.com
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Getting the below error once try to install the one with 40 mb size
[Windows Mobile Development and Hacking General] Hickrm:
How do I solve the flickering issue?
[Windows Mobile Development and Hacking General] sensorial:
DPI Changer & Checker For Game - Apps on Google Play

DPI Changer & Checker for games - Display fps & resolution repair for screen

play.google.com

Install the applications and set the resolution to 1080x1800
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
This is not working for me, it keep saying that no mob client installed
[Windows Mobile Development and Hacking General] Hickrm:
I receive the error when trying to change the resolution on android 14
[Windows Mobile Development and Hacking General] Hickrm:
Wasn't able to change the dpi and resolution on android 14. I have changed android auto resolution on the connected to the car phone and seems slightly more stable at the flickering until I find out how to set the actual resolution in the android auto developer options if that helps anyone
[Windows Mobile Development and Hacking General] Hickrm:
Sorted it through adb and an android tablet thanks @sensorial
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
can you please guide me how to do it, i have the same flickering issue
[Windows Mobile Development and Hacking General] Hickrm:
- I downloaded Pixels: resolution and dpi changer on my tablet

- opened the pixels app and it will say you need enable abd to change resolution

- plug the tablet into my laptop and downloaded android platform tools and enable usb debugging.

- followed the instructions on the pixels app and copy the code line required to be able to change the resolution on the tablet.

- changed the resolution to 1080x1800

- plugged in the dongle to the tablet and changed the settings as per the post from sensorial
[Windows Mobile Development and Hacking General] scaror:
This is one way to set the correct resolution. There are two other ways mentioned in this topic (a lot of pages back):

Use adb to set 800x480 as resolution of your Android device, connect the dongle and use AutoKit to set the resolution to 800x480 and then use adb to restore the resolution of your Android device back to the original values.

Not sure if this is still working, but a few months a go I downloaded a version of Autokit from the Carlinkit website that allows to set a custom resolution, not just a few predefined ones. This is a hidden menu accessible by tapping the screen a few times. (About 1:00 is this video

)

I'm not able to play the video, unsupported format. Are you referring to the flickering of the bottom bar in Android Auto? We're all having this issue and it's unsolved.

After configuring the dongle, you may delete Autokit from your phone. It's not needed for Android Auto.

This flickering was distracting me too much. I also suffer from Android Auto disconnects and reboots of my phone after +/- 30 mins of use with the dongle. I bought a cheap iPhone with cracked screen that I keep in my car and use for navigation. This setup is stable after a few months of use.
[Windows Mobile Development and Hacking General] Hickrm:
The flickering was

The flickering was the maps 'tab' changing from the left hand side to the whole screen every couple of seconds but this seems to of been sorted with the change in resolution.
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Bro i have installed the app and changed the reslution as mention but not able to get the correct reslution as sensorial said
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
What is the correct details to put in the pixels app to get the corret reslution for the autokit app
[Windows Mobile Development and Hacking General] Hickrm:
The resolution I put in the pixels app was 1080 x 1800 (so it showed is on part of the tablet screen) then started the autokit app.

It then showed the 1080x1800 resolution. Hope this makes sense
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
This is the options i set Bro
[Windows Mobile Development and Hacking General] Hickrm:
Other way round height needs to be 1800 and width 1080
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
This is what im get also, can you show me please over you tablet the autokit app reslution results how it is looks like
[Windows Mobile Development and Hacking General] Ahmad Elhaj:
Hello @sensorial @Hickrm,

im still having the flickering issue, can anyone send me screenshot from the autokit application on the right resolution for the dongle
[Windows Mobile Development and Hacking General] Hickrm:
Is anyone able to help....I have factory navigation however I have put 3.8 then 3.10. however now when I use the car navigation the language is not English for the navigations ONLY. Yet everything else is in English?

I have tried a master and factory reset and different language packs it is just the navigation that is the issue
[Windows Mobile Development and Hacking General] lenko1:
Probably have something to do with your Mirror Link . Maybe start there.
[Windows Mobile Development and Hacking General] Hickrm:
@sensorial are you able to do another android autokit package for me? I am trying to resolve the issue where the factory navigation is in another language to the main English language. So will try to go down to 3.8 again and back to 3.10
[Windows Mobile Development and Hacking General] Kelerson1974:
Olá, poderiam me enviar os arquivos para XT264L2V ?
[Windows Mobile Development and Hacking General] STL1te:
.sec file is uploaded by sboot tool (i don't know where we can get it).

This file contains raw data blocks. After each block we have (maybe) SHA256 digital signature.

Now i want to build a custom .dll for WinCE 6.0. But i don't know how to do it.. Can anyone share a simple guide or some links to software that i need?
[Windows Mobile Development and Hacking General] RedRamage:
Side question here: When/If someone is able to complete crack this open, what's potentially possible?

Could a new GUI potentially be created? Might be possible to even totally replaces the OS?

And further side note: On my Edge there's the 8" MFT display of course, but there's also two 4"(?) displays in the dash. Would these ever be able to be modified?

Not that it's a huge deal, but it also sort bugs me that the right display changes color with the different selects (Entertainment, NAV, Phone, Climate) but the left display is always blue.
[Windows Mobile Development and Hacking General] flsdiver:
MFT is microsoft windows automotive 7. A crack could extend existing system to include more functionality/running more apps. It could also be a total replacement of OS. Lots of work to do, like tie into vehicle data (key one would be say GPS module). This will be a gigantic effort to make it happen. Crack is just the 1st step to take control/gain access and see what can be done.

Dash is it's own module and very vehicle specific, so very much less likely to happen, certainly not initially.
[Windows Mobile Development and Hacking General] apial:
Hi,

in order to make testing easier, I would like to create a bench setup. I already have an APIM + FDIM (Display) including the cabling and power source.

The problem is that originally it has always Power and Ground (Pin 1 and 37) and gets *waked* through the Can Bus. The BCM is sending a wake up message to the ICM and this one is acting as a Gateway and forwards the message to the APIM via ICAN - PIN 19 and 20

The question is, how can we simulate such a wake up message?
[Windows Mobile Development and Hacking General] lucasb8888:
An Aduino Uno with a CAN Bus Shield (seeed studio) can send CAN messages
[Windows Mobile Development and Hacking General] joutlaw:
Does anyone think it is possible to enable the trailer brake controller? Typically, this is done in IDS by the dealer who want to charge 1 hour of labor for 5 minute job.
[Windows Mobile Development and Hacking General] lucasb8888:
Yes I would believe so. Based on this thread it looks to be 720-01-01 that handles it

http://www.f150forum.com/f2/reverse-monitor-4-2-relocate-teaser-246026/index5/#post3445339

I have it on my truck. But you should be able to compare as built data from yours and someone with a similar truck
[Windows Mobile Development and Hacking General] wystewart:
Would someone by chance know what the wake up message data would be?
[Windows Mobile Development and Hacking General] sheltonfilms:
I would think its ignition status generated by the bcm.

This is then translated by the IPC to the I-can line to the apim.

As for technical message aka Hex message; I think you are just Gonna have to sniff it.
[Windows Mobile Development and Hacking General] wystewart:
I was hoping someone here might have the hex message as i do not currently have access to a vehicle with sync2 to sniff (sync1 yes, but I suspect the codes may be different)
[Windows Mobile Development and Hacking General] apial:
Thats all info I already wrote and I can send CAN messages. Sniffing is not that easy as you cant sniff on the Ican via OBD port.

I sniffed the other buses but without a starting point its extremely hard to find
[Windows Mobile Development and Hacking General] DanMc85:
My vehicle came with factory navigation, but I like messing with stuff so I figured that I would explore how this works. I was able to compile my file successfully a few days ago, not that I need it for anything. I noticed that I have a different Sync hardware part number than the example, but anyways... This mod does show up in Ford's Sync Programming tool.... FYI. They can see that the navigation flash was downloaded on a specific date and time.

I know all my module info, however I bet vehicles that are using random data probably have multiple modules showing in the sync programming page.

I uploaded a screenshot, but blocked out my vehicles data.
[Windows Mobile Development and Hacking General] sheltonfilms:
This search based on vin or serial?
[Windows Mobile Development and Hacking General] DanMc85:
Vehicle VIN
[Windows Mobile Development and Hacking General] DanMc85:
Hmm..... ever wonder what all those files are in the sync zip file off SyncMyRide.com are... :)