yashsingh1/xdaforums huggingface dataset:
[Android General] ericlus15:
Hi I attempted to root the 2016 honda pilot but on the last step I get permission denied error when attempting to run dirtycow exploit to replace the factory_reset.sh file with the modified one. Can anyone help, please. Thank you
[Android General] jersacct:
If you could post a screenshot of your attempt that may help troubleshoot.

Perhaps the permissions of the dirtycow binary aren't correct - try "adb shell chmod 777 /data/local/tmp/rootme/dirtycow", then try again.

If that gets you a little further, but the scripts don't execute, you may need to use the same chmod operation on the other files.
[Android General] purespin:
Poked around last night and decompile some of the apk/odex files pulled from the HU.

- ApplistUpdate.apk (package com.honda.displayaudio.whitelist). Nothing too excited here. The main class is WhiteListContentProvider which just opens the "whitelist-x.x.zip" file and return its content.

- ProgramUpdateService.apk (com.clarion.displayaudio.programupdateapp). There is a list of files defined:

private static final String[] mNecessaryFiles = { "r8a7791-koelsch-android.dtb", "uImage", "upldetect", "uploader.sh", "uploader_timer.sh" };

It is running as a system service and once a USB inserts, it will check if it contains these files and popup some messages. Looks like it is used by dealers to do some system update.

- PackageInstaller (com.android.packageinstaller). I think this is the app in the HU that is doing the USB install. Here is the interesting function:

import com.clarion.whitelist.AuthenticationApplicationData;
import com.clarion.whitelist.WhiteListManager;
...
private boolean isAllowedInstall(PackageInfo paramPackageInfo)
{
WhiteListManager localWhiteListManager = (WhiteListManager)getSystemService("whitelist");
if (localWhiteListManager != null)
{
AuthenticationApplicationData localAuthenticationApplicationData = new AuthenticationApplicationData();
boolean bool;
if (!isInstalledApplication(paramPackageInfo.packageName))
{
bool = true;
localAuthenticationApplicationData.setSignatureVerification(bool);
if (!"package".equals(this.mPackageURI.getScheme())) {
break label94;
}
localAuthenticationApplicationData.setFilePath(new File(paramPackageInfo.applicationInfo.sourceDir));
}
for (;;)
{
if (localWhiteListManager.checkInstallPermission(localAuthenticationApplicationData) != 65537) {
break label116;
}
return true;
bool = false;
break;
label94:
localAuthenticationApplicationData.setFilePath(new File(this.mPackageURI.getPath()));
}
}
label116:
return false;
}

As you can see, there is a "whitelist" system service is running in the background. I think this is the service that jersacct talked about before. I looked around for a while but can't find which apk is that system service.

This is my first time playing with Android system. Let me know if you need info from me or anything you want me to try.
[Android General] ericlus15:
Thank You jersacct, I think that did the trick. The command executed and I factory reseted the system. Now how do I know it worked. My restarted with all my settings, but when I run the "su" command I get file not found over adb. Thanks
[Android General] jersacct:
Sounds like the scripts may not have executed. Try the same chmod operation on the nefarious.sh and factory_reset_mod.sh files.
[Android General] jersacct:
Fantastic - I hadn't poked around in the android APKs. Looks like all we need is a cleverly placed "return true" in there. I might get some time tonight to baksmali & edit that guy to try it out.
[Android General] jersacct:
I should also mention the actual white list service is in /system/framework/services.jar/odex
[Android General] ericlus15:
Yes that was the problem. Thank You
[Android General] jersacct:
Thanks - were you on a Windows machine? If so, I can update the .bat file to perform those operations for others.
[Android General] ericlus15:
Hi Jersacct, Yes I used windows 10. Thank You
[Android General] se1095:
IP address

Where do I find the IP address for my Pilot.
[Android General] ericlus15:
If you go to settings, then Wifi, you will see Wifi Network List that will tell what the ip address of the vehicle.
[Android General] haxy:
Is this the current status?

Status: Working to identify source of APK verification and modify the system service that checks the whitelist.

Any further progress on this?
[Android General] enyce9:
That is the current status as I understand it.

Nothing yet
[Android General] nugzo:
If you have Android Auto, which you should, Google play music should already be working through AA. It and Spotify work fine as long as they're installed on your phone. Havent tried Waze on my 17 Accord because i'm completely happy with Google maps through Android Auto. Cant ask for a better Navigation IMO. I also installed Kodi with the Fire TV (light) build and that works great as well. On the 17 Accord we have a little more room for installs, 1.6GB i believe according to ES file explorer. Having my Security Cameras for home and work on my HU is pretty pimp!! Next i need to install Google Calendar and see how the widgets work out!
[Android General] KYBourbonBoy:
Android ROM Image

Either this is a really genius thought or dumb one, but here goes....

For computers, you can simply create an image of a hard drive of one computer and put the image on another computer with the exact same specs and the new hard drive works perfectly and seamlessly. IT depts do the all the time at companies.

I do not have the expertise to do so, but is it possible for someone with a 2017 Pilot or Ridgeline to COPY or create an "image" of their entire android OS of their head unit, so that us 2016 Pilot owners could take the image, install/copy onto our head units so that we can get Carplay or Android Auto working? I mean, from what I've read and kept up with on this thread over the past few several months, the hardware of the two years are IDENTICAL. It only makes logical sense that if identical, then programming functions of all of the automobile related electronics (ie. right turn camera, reverse camera, etc) would be the exact same (exception of VIN number and such) and we could copy the "new" 2017 OS to the "old" hardware since HONDA isn't offering us 2016 owners any support or upgrades.

Thoughts from those nerdier/smarter than I? This seems almost too simply.
[Android General] beingsachinalam:
Thanks ....

i am learning something new todays on this forum. :p

Thank You XDA! :good::cool:
[Android General] bmilla:
I have an iPhone so no google play music with CarPlay. i have all my music uploaded to Google music. and apple maps is horrible. i have waze, plex, spoitfy and Pandora installed on head unit working well.

---------- Post added at 03:28 PM ---------- Previous post was at 03:26 PM ----------

I have been installing apps for a few weeks now without issue. now all of a sudden every app fails and it looks like the issue is the upload of the new whitelist. here is my error

Backing up whitelist to /data/local/tmp/whitelist-15-02-2017--15-23-21.xml

Uploading whitelist

.\OneClickInstall.sh: [: missing `]'

Rebooting head unit

Press enter when head unit has rebooted and is connected to WiFi

i never saw the missing part show up before so i think that is were the issue is. anyone know how to fix this?
[Android General] Travito:
I've had some success getting apps to install. Sygic unfortunately (my biggest want) seems to be stuck at "Detecting Country" Anyone know a fix for this?

Also does anyone know if it's possible to have these sideloaded apps connect to the net through the hondalink app? I know that the internal browser and hondalink weather and stuff can access the net without WiFi, as long as my phone with the hondalink app is connected via BT. This doesn't work for the added-in apps though.
[Android General] nugzo:
This thread is a big deal. Fairly new technology. Can't wait for some serious development. Google play services would be nice. Imagine exposed with viper 4 android and some serious sound quality upgrades.recovery with Custom roms..Can't wait for a successful storage option to install all the apps you want. Nova launcher...we're in there! wish [MENTION=2376614]jcase[/MENTION] had a new Honda lol.
[Android General] jcase:
donate one for the cause!, ive got a 16yr old that i owe a car to lol
[Android General] jshazlt:
Please help me! Thank you!

Hello, my ApplistUpdate.apk is deleted, can send me a, thank you, my email is jshazlt@gmail.com
[Android General] mcgee235:
Thanks jersacct and purespin for this awesome hack. I was able to install Waze on my 16 Pilot last night without any issue.

During this morning commute, Waze was working great. I have both music and Waze audio alert working.

Actually, I noticed an issue with Wifi right after I have my headunit rooted. It kept connecting and disconnecting to my Wifi network (with my router at home as well as my phone wifi hotspot). When I tried to connect/reconnect, the options for available networks and wifi information on my headunit were greyed out. Is anyone facing the same issue?

Other than that, everything is great for me. I used to keep a tablet on my car for Waze, now it no longer needed.

For the next step, I'm thinking about install Tasker so that it can launch Waze automatically.
[Android General] nugzo:
I promise if i hit this powerball, i'll gladly donate my '17 accord. Perfect car for a 16 yr old lol.
[Android General] mcgee235:
I got the same issue. Have you figured it out yet?
[Android General] haxy:
Any more progress on the civic?
[Android General] billyrule:
Going to try this on a 2017 Honda CRV today..

thanks for all of you folks ..
[Android General] Richiiee:
[MENTION=3242718]jersacct[/MENTION]

What are the directions to revert this exploit? Is it as simple as replacing the factory_reset script?

Only reason I'm asking is because the HU runs too darn slow for multiple apps to be running and audio issues, so this is pretty much pointless to me for now.
[Android General] enyce9:
Wondering the same thing....
[Android General] TWINTRBO:
As far as I know, it hasn't been reversed yet. I thought it was spelled out from the onset that the head unit was not a tablet, it will only run a couple of small apps and that's all. I think your hopes were a bit high for it's real world usage.
[Android General] ibashe:
No luck on 2017 CRV as i could not access into the head unit over adb.

I tried both over WiFI and USB.
[Android General] stilger:
I just realized the scripts did not make a backup copy of /system/etc/factory_reset.sh. Did anyone happen to save a copy? I have a 2017 Accord. I am not sure if the script is different between cars.
[Android General] billyrule:
I read one post they use an overclocker app to speed up the HU by 25%.
[Android General] y2jdmbfan:
So 2 questions...

Can this be done on 2017 USA Honda Pilot's?

Can this be undone?
[Android General] y2jdmbfan:
2 more questions,

I would like to install Waze, Plex, Hulu and Netflix. Any problem with any of these?
[Android General] TWINTRBO:
As I've said before, it's not a tablet, you will have trouble running all of that. It will be very laggy at the very least and don't expect the steering wheel controls to work.
[Android General] y2jdmbfan:
Well I didn't plan to run them all at once, Plex works pretty decent through the web browser. Thought it might be better installed natively. Waze should be OK though, correct? Just excited about the prospect of being able to hack and install a couple of apps so I don't have to bring my iPad with me all the time.
[Android General] Living Lejuhnd:
Blank post for editing format of tutorial here:

https://xdaforums.com/showpost.php?p=71331595&postcount=404
[Android General] hogcaller:
Lejuhnd,

Thank you for putting this tutorial together. I've been planning on installing Waze in my '16 EX-L for quite a while but haven't gotten around to it yet. I'll definitely use your guide when I do.

Have you tried using waze and listen to music (specifically SiriusXM radio or FM) at the same time? Do both work and if so do Waze directions play over the music? Do the steering wheel controls for the audio unit (volume/channel) work while Waze is running?

Thanks again,

-phil
[Android General] Living Lejuhnd:
Hogcaller,

No problem. I was just about to come on here to report my findings during my first Waze usage today.

- Audible notifications were nearly impossible to hear. They did play over the music, but were incredibly quiet.

- I could navigate through menus while in motion, but once I had to input text/numbers and the stock head unit keyboard was brought up, it was grayed out until under 5 MPH.

- FM radio played perfectly fine while Waze was in use. I do not have Sirius so I did not get to test this.

- Steering wheel controls were lost ONLY when I was on the primary navigation screen. When I was in any menu or setting screens I could control audio through steering the steering wheel. Primary navigation screen however is the screen you will be on the majority of the time, so this is an annoyance.

I also had my head unit tethered to my iPhone for one way of the drive. I then disconnected it on the way back and it still worked, at least in regards to my car's location in regards to the road. I suppose the map is stored to internal memory somewhere. Curious if anyone can elaborate one how well this works and how far you can take it without being tethered.

Overall, I've very pleased with my experience. While it's a little buggy, that should be expected from a hack like this. Now that I have experienced a few of these issues first hand, I'll go back and re-read through the threads to see if there are any clear solutions to some of these issues. If so, I will update the tutorial accordingly.
[Android General] Living Lejuhnd:
Another quick thought that I can add to the tutorial. In my situation, I was unable to get my car a steady connection to my home network. The router is at one end of the house and the cars are parked outside on the other. I could connect sporadically, but the last thing you want is to lose connection while the script is running and have a half uploaded file!

One solution is to take any old wireless router and plug it in near your Honda. As long as your PC of choice was a laptop, or it at least in range of this router, this will work. The router doesn't need to connect to the internet to work. All you need is the vehicle and computer to be on the same network. As long as the router is plugged into the wall and both devices can see it, they should be able to connect and communicate.
[Android General] chintito:
what about using mobile hotspot?
[Android General] Living Lejuhnd:
This should follow the same premise. As long as they share the same subnet as discussed in the tutorial, they should be able to communicate with each other. I actually tried this approach first, but for some reason my laptop would not connect to the hotspot.

Besides the ipconfig command to compare subnets, you can go on your PC, open the command prompt and type:

ping (insert IP address of vehicle here)

Like this:

ping 192.168.1.248

If you get a reply, then they means you're able to see that device.

I suppose this is not 100% foolproof as you could be on a different subnet where there could be a another device with the same IP as your vehicle, but unlikely.

You'll be told pretty quickly after executing the script if you're connecting to the device as well.

EDIT: For further clarification. Green box shows a successful ping which means that the pinged IP address is on the same subnet. The red box shows a failure, which in our case would mean that it's not on the same subnet.

An attempt where both PC and vehicle are not connected to same subnet will yield the following results:
[Android General] TWINTRBO:
I used my cell phone as a hot spot, worked great as well.
[Android General] majedalanni:
have question about the 2016 NA civic

tried a lot of things but most failed, but I got something maybe can help us

tried to install a modified AHA radio but it fail and the logs show this keystore data (whitlelistLIB said it not match below)

[308203543082023ca00302010202044f249266300d06092a864886f70d0101050500306c310b3009060355040613025553310b3009060355040813024341311230100603550407130950616c6f20416c746f310f300d060355040a13064861726d616e31123010060355040b130941686120526164696f311730150603550403130e546f727265792041746369747479301e170d3132303132393030323731385a170d3339303631363030323731385a306c310b3009060355040613025553310b3009060355040813024341311230100603550407130950616c6f20416c746f310f300d060355040a13064861726d616e31123010060355040b130941686120526164696f311730150603550403130e546f72726579204174636974747930820122300d06092a864886f70d01010105000382010f003082010a02820101008768149ba6732a4978c6f74c7392419c26f168d9a818f40999b9d05365b42c200811f4d427a101d59714a68f299a5b9971afcb82c4d2f33ecaa4e953205c92388dc163d1da2cb9f26d154f985fa0f664ae43673149113cdb282c2a235edf253d01a737a2a6c69991bc5cecbe0ededae7b7e99a0b9d70b1ca94780959f0df465073a164cf51307a5b218ffb321fe97d637de43950d76568745bb2c9a2fe45a4c3b17e812b794bc0469b54309b6691fcccb3289a8e28fae962c66b55b5da0e0d9f36703722ce1087064ac643f5aa72803d715088506ebf6ca0fc1c266ae045bb35be962e08dbb262fc603e13d3ae6487da4c32dc6a18466b59ba95a6c08c52a5f90203010001300d06092a864886f70d010105050003820101000589e3b92394079be75a09d956b4d17616eb1460cb9262375ec0976aef4c3e186b0891471653832f83908ab1971f0f626db8fe34283b971a7e4ec07e7f6957ca2fcc26fae70384f49978f5a49647fc24628429a93c867ff16ed547ae7eaa31a2798350ceebba33328467aa633ffb78019b5e5941323bfa872f8d9dbb9918973e4df66ea83d317088947e4d405b208c12e76b4de2dbab8114eada507806892a79da84beabdb68d385cb8c809e4414f61ab29c791dc93a62cc840d38ad4787bfc9dec38c3d4f9eeb9bbfa01a169d191a24b89f97f82756e3a39fb20cd80b63ea7734765539226f3e0c6b635093ec7cfe78c919fcedefd21cc1e7b20b27c45ab3c9]

Can you we use this keystore to with AHA and inject another APK on anything can help us to get shell or copy files or anything?

I don;t know what is keystore and what they are.. are they private keys?

Mike
[Android General] Living Lejuhnd:
I'm sorry, I'm not sure I completely understand your question, or if I'm qualified to give an answer, but I'll share what I know.

The keystore attribute is pulled from each APK file, and is unique to each APK. This is it's signature, and is pulled prior to installation. If the key is not the right one, the APK won't be installed.

In regards to the script, this is done with /bin/GetAndroidSig.jar. This is a Java command that needs JRE running.
[Android General] majedalanni:
For the civic the only APK we can install is the AHA radio... And above is the keystone that head unite trying to check. My question is there a way we can hack another apk or use same aha apk with injection of another apk without breaking the keystore above? If we can do that might we can install somthing in civic and get root
[Android General] Living Lejuhnd:
To preface again, I'm far from the best one to be answering these questions, but I'll share what I know.

First off, I'm on a 2016 Pilot. I have no idea what the differences are between Pilot and Ciivc head units. I'm still having trouble following your question, so I'll break it down as best I can:

Sure. You can take any APK, run java -jar bin/GetAndroidSig.jar (apk name here) and it should return the signature.

If you're talking about manually entering a signature, this is doable too. Modify the whitelist-new.xml file with a text editor before it overwrites whitelist.xml and add whatever changes you want to make.

I'm not sure what you mean by breaking the keystore.

Installing an APK and rooting are not the same. Rooting is needed to be able to install an APK. This is done with the dirtycow exploit.
[Android General] majedalanni:
I'm so sorry for confusion

Civic head unit looked so well. We don't have developer option as it asked for something called passcord and there is no way we can enable adb.. port 5555 closed. The only port open is 5000 and its not for adb.... Our hope we modify aha app to get something asking we don't have unknown source option too
[Android General] ispofe:
I successfully used a portable hotspot (TP-Link) for mine since my router was too far away.

I recommend to configure the hotspot to assign the head unit to a fixed IP address, so it does not change each time the HU reboots.

Also remember to either match it to the one in the oneclickinstall file, or edit the file with the head unit's IP address.

I read somewhere it is not a good idea to use a cellphone's hotspot, due to some issue/restriction.
[Android General] majedalanni:
have couple question

1- is 2017 honda HU made by mitsubishi too?

2- what do you mean you enabled USB? (do you mean in the menu that you can change the role from host to device?

3- how you define the driver for the pc when you connect it via device role? as mine showing usb cdc nmc?

4- did you think if we can console to device via usb ?

Mike
[Android General] ibashe:
1. I don't know who made, how can I find it?

2. Yes, from the menu you can change from Host (Default) to USB device.

3. I'm using Mac and didn't ask for driver, basically it came up from "Network" settings with an IP address.

4. That's what i was trying to access, no luck with ssh, telnet, adb etc...

Idris
[Android General] hogcaller:
Lejuhnd,

Thanks again for your tutorial. I finally got around to add Waze to my '16 EX-L with safety cameras.

Rather than using 3.9.9 like many others, I decided to try the latest apk I could find. I installed 4.20.0.1 without a hitch (well one minor hitch when the wifi signal got too weak when the apk was being installed, but rerunning the script was sucessful).

Waze runs smooth on the HU, and seems to work fine with the same issues others have reported - very low navigation voice levels and non-functional steering wheel volume controls when Waze is on screen.

Additionally, it seems that Waze has problems using the system time to switch between day an night view. For example yesterday at 4:30pm Waze wanted to use night mode when it was still full sunlight outside. Has anyone else seen this problem? Also voice navigation does not work, are 3.9.9 users able to use voice navigation in Waze?

-phil
[Android General] Living Lejuhnd:
My pleasure Phil.

Yes, I also face the system time issue. I seem to be running night time sometime around 3-4 PM EST. Not sure why, or how this can be fixed.

I have not tried voice navigation, so someone else who has would have to chime in here.

One thing I noticed was if you change the audio feed to "Audio Apps", you get full, loud and clear Waze. But of course, this is not ideal.
[Android General] majedalanni:
Tried a lot of things but most fail... But still trying... Might there is another menu somewhere
[Android General] hogcaller:
When I installed Waze this weekend, I'd forgotten about this post from late last year (https://xdaforums.com/showpost.php?p=70112919&postcount=282). In it purespin states that he has audio working correctly by changing the whitelist properties. It's not clear to me that he's got audio while running XM/FM, or if like you when Audio Apps is selected. I'm going to try to figure out how to make the whitelist changes after the app is installed to see if I can recreate his results.

-phil
[Android General] danny7139:
Interesting, thanks for this!
[Android General] THORMUNZ:
Would this work on a 2017 Honda Civic? The head unit looks similar to the pilots but not entirely sure if they're on the same firmware. Anyone generous to try or confirm this works?
[Android General] Living Lejuhnd:
Try a quick search on the thread. I remember seeing people discussing Civics, but don't remember the verdict.
[Android General] THORMUNZ:
I kinda did that right after I posted and saw that it isn't compatible, what a total bummer.