yashsingh1/xdaforums huggingface dataset:
[Connected Car] Crunchy_Nuts:
Sad to hear...:crying:

But there must be some possibility for the recovery mode, or not?:confused:

I mean, as a developer you always have to keep a back door clear in case the system breaks.:confused:

What if you try to use the usb stick?

As far as we know there's an option called engineer mode.

# Activate engineering mode
# engineering_mode=0 (Absent) engineering_mode=1 (Present)
engineering_mode=1

Maybe it has another effect.

My ideas would be that maybe you can use it to call a function / module to unlock.

Like this:

# Create one spy
# create_spy=0 (don't create spy) create_spy=1 (create spy)
create_spy=1
# Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND
sync_spies_with_usb=1

Or maybe just leave the USB Stick (with engineering_mode=1) plugged in and see if something changes at the ports.

And maybe the engineer mode is bound to an "id" to work.

To copy spylogs you also need engineer mode and an id (id = ???).

It won't work without the id.

Search for something like this:

#USB Demo file
[general]
id=

This is the complete procedure to copy spylogs from nac directly to usb without doing anything.

#USB Demo file
[general]
id=?????????????

# Activate engineering mode
# engineering_mode=0 (Absent) engineering_mode=1 (Present)
engineering_mode=1

# Create one spy
# create_spy=0 (don't create spy) create_spy=1 (create spy)
create_spy=1

# Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND
sync_spies_with_usb=1

---------- Post added at 12:34 PM ---------- Previous post was at 12:02 PM ----------

Found it!

The id is ->

9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f

You find it under rootfs\usr\bin\sem_dm_server

So the complete content of the usb file is

#USB Demo file
[general]
id=9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f

# Activate engineering mode
# engineering_mode=0 (Absent) engineering_mode=1 (Present)
engineering_mode=1

# Create one spy
# create_spy=0 (don't create spy) create_spy=1 (create spy)
create_spy=1

# Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND
sync_spies_with_usb=1

Create a file and rename it to ID (without any file extension!) and copy the code above into the file.

Copy the file in the root directory of the usb stick and plug it in to the nac.

After you insert it in the nac, it will copy the spylogs to usb.

And maybe you can do other things with the engineering mode. :D
[Connected Car] horuscurcino:
[MENTION=10164697]MitchtheMitch[/MENTION] did the extraction using the firmware file from web and binwalk.

I have compiled both Rui.Saraiva and mine extractions. There is the link: shorturl(dot)at(slash)ozMS8
[Connected Car] rui.saraiva:
[MENTION=10164697]MitchtheMitch[/MENTION] I did try the USB2Eth device after a hard reboot (long press on the phone toggle switch), the device is detected and the module is loaded, but no iface configured. Exactly the same if I plug it later.

[MENTION=9078532]Crunchy_Nuts[/MENTION] The SWL\*\Firmware\FirmwareList.ini has lines such as:

INSTALL_PACKAGE 0x0 oip-ssw-security-usergroup-helper-swl
DELETE_FILE /Data/mnt-wt/MessagingAppl/node/MsgTemplates.db
INSTALL_TAR_FROM_FILE / 42129 $(MEDIA_ROOT)/SWL/001315031486100876/Firmware/AUTO/1010113/ALL/OVIP/efs-app-data-resource.tar.gz
DELETE_FOLDER /mnt/mmc_ovip/media/datastore/radio

So maybe there's a way to write directly to the filesystem.

[MENTION=3117564]horuscurcino[/MENTION] Your files are from a Chinese NAC firmware 22.06.17.42.
[Connected Car] NooBtheNoob:
Hello [MENTION=3117564]horuscurcino[/MENTION] can you explain how to do that?
[Connected Car] MitchtheMitch:
Did you change the ip address for the ethernet device to 192.168.2.122?

Netmask 255.255.255.0
[Connected Car] horuscurcino:
It needs Linux.

https://github.com/ReFirmLabs/binwalk/wiki/Quick-Start-Guide
[Connected Car] rui.saraiva:
The network interface isn't configured. You can see that in the engineering mode cheatcode (1140 IIRC) or dmesg - you can force create a new spylog (press and hold the 4th toggle switch (vehicle button) until you hear a beep) and extract that from the .dlt files. I had my network interface in promiscuous mode and no traffic. I also did try running a dhcp daemon to no avail.
[Connected Car] MitchtheMitch:
When you connect the ethernet adapter and then press 1140 in the engineer mode, it should show you an ip.

Maybe it is only working when you use it with the dlt viewer.

It is described that way in the dlt. Service data.
[Connected Car] Crunchy_Nuts:
Any idea how to extract the .FRG (file extension) data?
[Connected Car] rui.saraiva:
The usr/bin/swl-manager binary handles that .FRG files (and all the update process). It seems those fragment files are kind of .tar files - bunch of files and metadata. The first 11 bytes are always the same (signature+version?), they have an header with some commands (RUN_EXECUTABLE is one of them) and fields such as number of files, file length, checksum.

I did extract the readwrite-data.tar.gz file from 1010110.FRG, using binwalk. The 401021*.FRG have .s files with some sort of xxd dump and the *_no*.FRG are "empty" fragments, only header+metadata - it might be useful to understand the format.
[Connected Car] M@ldys:
Hi guys! Anyone know if is possibile to send G. Maps (using Android auto connection) on the 3d icockpit screen, like the stock Nav on a new Peugeot 208?
[Connected Car] rui.saraiva:
No, you can only see the AA (and CarPlay/MirrorLink) in the central touchscreen. That infotainment system is basically the same used in older cars. The 3008 can have the NAC Wave 2 or 4 (in HYbrid/HYbrid4 versions) and the 208 the NAC Wave 3 or 4 systems.

Or RCC Wave 2 and 3, in systems without integrated sat nav.
[Connected Car] boubaka:
Hi guys ! :)

Did you manage to progress in the project? I am very interested in your work ! :good:
[Connected Car] daewoo74:
Hi , it's possible connect android auto wireless in my new peugeot 2008 ?????
[Connected Car] Crunchy_Nuts:
Wrong thread friend.
[Connected Car] enzolo42:
Hi Rui,

Did you succeed to dump the filesystem ?

I would like to know if there are tracklogs, location and routes history inside.

Thanks

Regards
[Connected Car] rui.saraiva:
The filesystem dump was already posted.

But that information you might find it in the spylogs.
[Connected Car] NooBtheNoob:
Thanks to [MENTION=3117564]horuscurcino[/MENTION].

I tried the uart method on the nac and it seems to work.

I wanted to add photos here, but it does not work :(

I could even extract data.
[Connected Car] Piest4r:
With stuff like this the manufacturer's showroom should have adjacent or connected maintenance garages who may help with codes etc. They're guaranteed to know them or have access to people who do. Did something similar with my car before (Renault) but I bought it there, they might charge if you didn't.
[Connected Car] NooBtheNoob:
It's about extracting the fw from the nac not about changing things on the nac.

Peugeot can't do that.
[Connected Car] dpeddi:
I think it would be nice to find out /Data/mnt-wt/public/efs/SecurityFwkInstaller/ca/psaRootCACert.pem,

/Data/mnt-wt/public/efs/SecurityFwkInstaller/certs/ovip_cert.pem and

/Data/mnt-wt/public/efs/SecurityFwkInstaller/keys/ovip_rsa_2048.key

these should allow to unpack encrypted firmware
[Connected Car] ecoli79:
Hi everyone! Firstly, sorry for my english :o

Tell me, please, how I can get access sql-lite data from nac? Can I do it directly from nac throw ssh (telnet) by wire?

I want change my RT6 system to nac in my peugeot 508 first generation.

Thank all :)
[Connected Car] dtosun:
Anybody know how can I replace RCC with NAC?
[Connected Car] Il gladiatore:
NAC screen resolution

I am using the screen2auto application to transmit the phone screen to the NAC, only not knowing the resolution I find the image cut on the sides.

I wanted to ask the community if they know the NAC "SCREEN WIDTH / SCREEN HEIGHT / DPI" screen resolution. thank you
[Connected Car] rui.saraiva:
https://developer.groupe-psa.io/webportal/v1/overview/infotainment-system/#screen-size
[Connected Car] dpeddi:
interesting...

on my wave 3 i have no extra app except the "peugeot" do nothing app...

It would be interesting if the nac check the https certificate or if it accept self signed one.. if yes it would be possible to build a proxy and deploy our app.

Maybe it could be possible to reuse snippets from https://github.com/Mwyann/psakey/
[Connected Car] GuestD4234:
I have found keys to decrypt firmware in Github "psa-nac-firmware-reverse-engineering"

I have uploaded firmware, decrypted-extracted firmware, and script_keys in google drive to make it easier to download anyone who is interested in this.

"drive.google.com/drive/folders/1_twUGEcjGGxYGINgGsaCYC23DraC8pNx?usp=sharing"

PS: I am no expert in all these, just here to find a way to enable 5GHZ (wireless), wireless android auto, and tomtom traffic in Australia.
[Connected Car] VLud:
You can't do that from reading the firmware, the Code Signing Certificate key is mandatory to be able to do anything interesting.
[Connected Car] turbare:
following this
[Connected Car] galaxys:
Bookmarked as well....
[Connected Car] therabbitwindfall:
Using Windows 7-Zip you can open FRG file (sure only decrypted). But 7zip say that is not a full pack. I think it's simple some type of archive splitted on a parts.

What exactly part should be used you can find from FirmwareList.ini
[Connected Car] bennebartsch:
Very interesting thread, thank's for sharing all your work!

I am searching for a way to control things like the backlight of the NAC or Climate externally. Any ideas?
[Connected Car] therabbitwindfall:
Use CAN-bus. For example Arduino+CAN Shield
[Connected Car] bennebartsch:
Is there any documentation about the CAN Commands or do i need to reverse engeneer?
[Connected Car] therabbitwindfall:
I don't saw open sourced CAN commands :) Start from here hackaday DOT com/2017/05/04/reverse-engineering-the-peugeot-207s-can-bus/
[Connected Car] therabbitwindfall:
And they done this with recovery USB that make full reflash. Image of whole firmware (base) and after that they can install prod firmware. But I don't know anyone who doing this. All sales-managers instead sell you new NAC or used one. Just business... ((
[Connected Car] carson512:
I got rootfs\usr\bin\sem_dm_server is file and use ida to open. Can't find the id you said...

Also I try to modify the rootfs.fsn.Then may update use the modify rootfs.

But can't encrypt ....

I just decrypt rootfs.fsn02.And use the crt file in SWL to encrypt the rootfs.fsn02.

But the file out is not same with the original file. Is that the public key or encrypt command error.I think just the key error.

How to find the original public key.
[Connected Car] tuncina:
Selam,

Yazdığınız her şeyi uyguladım ve yaklaşık 50 "dlt" dosyasına baktım. Ancak araçta bağımsız telematik kutusu için IMEI numarasını bulamadım.
[Connected Car] gyorgy.dobak@gmail.com:
7503900

Password
[Connected Car] Il gladiatore:
Is this password also valid for the 2017 NAC? it is possible to install android apps on the NAC, since it has android auto it must have a small android system where you can install applications.
[Connected Car] kolomparrudi:
I tried to use the cerficate shipped with the firmware to encrpyt, but the firware keys can't decode it, so not this certificate used for the encrpytion. I managed to create self signed certificate from the firware key and can encrypt the firmware back, but I'm not sure if device has any certificate check.

Here is how I managed to do it:

openssl req -new -key Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.csr

openssl x509 -req -in Firmware_Keys/WAVE2/21.08.84-12-r0.csr -signkey Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.crt

openssl smime -encrypt -aes256 -in SWL/001315031601451350/Firmware/AUTO/1010103/NAC_B2/OVIP/rootfs.fsn -binary -outform SMIME -out rootfs.fsn.enc Firmware_Keys/WAVE2/21.08.84-12-r0.crt

Used this github repo for the firware keys: https://github.com/ludwig-v/psa-nac-firmware-reverse-engineering
[Connected Car] jamesD92:
with regards to these Firmware_Keys on the github site above, does anyone know how these private keys are being generated?

@kolomparrudi did you get any further proving the self signing method works on a NAC unit?
[Connected Car] jamesD92:
GitHub - sabsteef/psa-uds-nac: A short sort of karma and security, with code inside.

A short sort of karma and security, with code inside. - sabsteef/psa-uds-nac

github.com

This might be useful to some people ;)
[Connected Car] just4u32:
Did you manage to unlock nav or 5ghz? I'm trying too but couldnt find any info.

Thanks
[Connected Car] Arkady.es:
BRILLIANT!!!!

I wonder if I can use your method to create a file with commands to deactivate completely the bluetooth connection. I guess there would be something like bluetooth_module=0.

Do you know how to find it??

In addition, I don't understand how to get the ID. How can I access to rootfs\usr\bin\sem_dm_server?
[Connected Car] Arkady.es:
Hi @carson512. You are many steps forward me to reach the id as @Crunchy_Nuts said.

Would you mind sending me some guide or some tips to access the filesystem? It has been said here it was posted in the forum but I have not find it.

If anybody has the post I would really appreciate it.
[Connected Car] futee:
Hi Friends!

Is there any solution to open a hidden colour scheme in Peugeot 5008 icockpit?
[Connected Car] wxhank:
up up, how to install wave4 firmware on wave2
[Connected Car] ricjuh:
I want to know if it's possible to disable to black bars on widescreen display.. On the PSA website they say this space is dedicated to the infotainment system. But it's really anoying to have a 'premium' display with 2 black bars and no widescreen support.

View attachment 5442239
[Connected Car] futee:
No!

As you can see on your picture the side has differnt resolution and can not show the high resolution objects. It is a shame that PSA can not install fully high resolution display. the price difference should be coins.
[Connected Car] ricjuh:
The screen has 1 resolution of 1920x720.. It's just divided by PSA to show different info.. During a software update the whole screen is used so it should be possible somehow to trick the system in showing fullscreen stuff.
[Connected Car] futee:
I'm waiting that update....
[Connected Car] MrPoofy:
Do we have any news for the Android Auto Full Screen?
[Connected Car] aleabry:
Hi, I have a peugeot 208 allure latest model 2022 without navigator, I changed the rcc module with a nac wave 4 with two video outputs one connected to the icockpit 3d. How should I do to enable (with arduino plus can bus) the navigator, thanks
[Connected Car] futee:
Hello! I had ask a professional about the full screen, here is the answer:

"Not possible without being root and even being root it is almost impossible because each part of the screen is a separated process (and it is a proprietary binary to edit)"
[Connected Car] ricjuh:
I hope that in the future some parts of the software are becoming opensource, so we can choose what we want to display on the screen instead of being forced to use this layout :(
[Connected Car] Nabil2106:
hi everyone,

I changed my RCC to a NaC wave 4 HD on my Peugeot 2008 II. All worked properly, but I had a very (very) bad idea to update the firmware.

Now my nac is blocked on the Blue screen “downloading on demand” every time I try to put the firmware using the VIN donner to have the license, I have the message “firmware update error” In the middle of the update.

I tried everything I found and the result is always the same. Whiteout license the result is the same also.

If you have any idea I will be grateful
[Connected Car] NeeK9:
How you get in this menu? Can you share?

In a unit NAC without Navigation can be enabled Navi and installed maps?

Thanks in advance
[Connected Car] Kevanweerdenburg:
I know this might be old news to some, but I recently leaned that peugeot sells 208's with different UI in Argentina.

You can see it in action in this video

Does anyone here have some more information about this software? Is it running on the same hardware as the European models? I hope this is an indication that it might be possible to install on other units one day. I would love to have some more screen space for Android Auto like this seems to have.
[Connected Car] louisthesnoopy:
Oooh this gave me a spark of hope that there might be a way to get something closer to IVI on the NAC systems. But the screen is recessed compared to eu models where it is all one flush plane. So hardware is probably not the same.
[Connected Car] RuLe89:
Hi guys, in the previous messages I saw that you can access the files on the device, how is it possible to do this? I should try to replace some images inside
[Connected Car] leelowi:
Hello,

Do you have same file with NAC? Would you please share the file?

Thank you so much!
[Connected Car] rui.saraiva:
That's a AIO (All-In-One) CRONY infotainment system, it has different hardware.
[Connected Car] electro_bordeaux1:
hello to all xda members

I have a Citroen C3 Bosch PSA RCC A2 car radio which no longer wants to turn on but first it gave me a system error message then after that nothing more is there a solution to solve this problem and thank you very much
[Connected Car] catanutapllunga:
Hello everyone, I had a problem with my car . I changed the battery and after that the CD radio asked me for a code that I didn't have.I removed the radio and the serial no is:BP730181889575.

I searched on the internet but did not find any code. While searching I found a site that gives me the radio code. Has anyone used this site? I'm curious if it's a scam or not because I don't want to be tricked.
[Connected Car] oscar.troncoso:
hello is possible access via serial cable? I Have a multimedia but not have enabled blutooth, anybody knows how enable without a scanner psa?
[Connected Car] Picard_XDA:
Audio: NAC Wave 2 - basic audio system with no subwoofer, maybe its possible to get this info??

Technical question about the balance modes "All Passengers" "Driver" "Front only"

1. For each mode I would like to know if there are any time alignments and what the delay is for each speaker?

2. For each mode, is there an "allpass" filter and if so, what is the frequency of it?

3. Finally, is it possible to disable allpass filters and time delay from the settings of the NAC unit.

Cheeeeeeers
[Xiaomi Redmi Note 5 Pro Questions & Answers] Ichijou Raku:
Hey i want to update my firmware (not ROM!!) to the latest ARB build, so if i do that can flash any Custom ROM ( Oreo-Pie ) without having hard brick??

I'm so sorry this is my first XIAOMI Device. Hehe

:confused::confused::confused:
[Lenovo K8 Note Questions & Answers] jairel101:
Any?:confused:
[Nexus 5X Q&A, Help & Troubleshooting] meatwad0222:
I'm looking at buying a refurbished 5x, my ? Is; knowing the issues with various 5xs is there a place selling refurbs that will be free of most of these issues or is buying one just the same gamble?

I've owned one before and fixed the boot loop once before but then my child accidently threw it. /Shrug

Have a g6 but just want something that is more open development wise.
[Nexus 5X Q&A, Help & Troubleshooting] rp158:
[MENTION=2007186]meatwad0222[/MENTION], don't know anything about refurbished N5X and the mine still works well, but 4 active Pie-ROMs ½year after introduction isn't a reason to buy one, IMO.
[Nexus 5X Q&A, Help & Troubleshooting] meatwad0222:
moto g6 has no solid development. there is no continual rom development and i dont have the time to try myself. also whst 1/2 a year are you talking about?
[Nexus 5X Q&A, Help & Troubleshooting] rp158:
[MENTION=2007186]meatwad0222[/MENTION]: half a year after introducing Pie.
[Xiaomi Mi A2 / 6X Questions & Answers] honey ghumaan01:
i wanted to factory reset, so i booted recovery into slot b, and applied factory reset, i wanted to clean internal storage too so i selected it and cleaned it too, everything went good with no problems, NOW my question is, how did it clean internal storage which is slot b, because recovery was booted in slot b, and it should only be able to clean slot a, i had gapps flashed into slot b and playstore is still there after reset, can somebody explain this to me, how recovery managed to clean internal storage of current slot, or it dint clean it, i am saying it is cleaned because there is no folder of old apps like whatsapp, please reply
[Networking] kinobi:
Hello,

I'm using WM6 german version by MaxStegi. The problem I have is that our network uses a WPA2-PSK cryption, but I am not able to choose this option in my mobile device. Maximum is WPA-PSK. Shouldn't WM6 be able to work with WPA2-PSK? What am I doing wrong?

Please help me.

I forgot to mention that i use a htc universal.
[Networking] Basti756:
My answer might not help you that much, but all I read about the Universal was that it supports just WPA. Just in case it is possible to use WPA2, it would only be software based which causes a slower transmission rate.
[Google Pixel 2 XL Questions & Answers] 100rabh7791:
I have no idea why we don't have a stock Equalizer? The sound of Pixel 2xl is so disappointing, lacking base and no way to tune equalizer because there is none! except in the google play app which i do not wish to use. I have tried a few external equalizer apps but all have failed to do anything.

Any suggestions guys?
[Google Pixel 2 XL Questions & Answers] Disney_Adidas:
I know you said you didn't want to use a 3rd party app but take a look at Eqfy, i was in your shoes before and i took a look at this app and i haven't been disappointed.
[Google Pixel 2 XL Questions & Answers] 100rabh7791:
No i said i tried few but they didn't work.

Thanks I'll look at this app and see if it works.

I just checked! It's a paid app and it works only for Spotify :(
[Google Pixel 2 XL Questions & Answers] Disney_Adidas:
it will lock to many apps and also has a global equalizer option
[Google Pixel 2 XL Questions & Answers] 100rabh7791:
Hi thanks before i make the purchase, can you confirm me if it works with say Amazon music app? that is currently the one i am using the most. If you can do that it will be very helpful. thanks
[Google Pixel 2 XL Questions & Answers] 100rabh7791:
Before i make the purchase, would you be so kind to tell me if it works with Amazon music app? As i use it the most
[Google Pixel 2 XL Questions & Answers] seabro01:
There is a stock equalizer. Works on Spotify , Play Music and probably other music apps.
[Google Pixel 2 XL Questions & Answers] Disney_Adidas:
Unfortunately it does not lock on to Amazon Music ... However, the global output should still work, but it will be less stable.
[Google Pixel 2 XL Questions & Answers] 100rabh7791:
Ah well. Thanks mate! I hope Google does something in next big upgrade about it.
[Google Pixel 2 XL Questions & Answers] pepins:
I've tried almost all, right now I'm with dolby without root and it works pretty well in deezer:good:
[Google Pixel 2 XL Questions & Answers] droverto:
Dolby without root? How can i get this?
[Google Pixel 2 XL Questions & Answers] pepins:
Dolby digital 1.6 apk
[Xiaomi Mi A2 Lite Questions & Answers] hayat55:
So, I bought the mi a2 lite as a gift for someone - it looks like a nice phone and it comes with android one which is a bonus. However, when testing the phone to see if it worked - it did a 'security' update but then upgraded it from android 8.1 to android pie (9.0). I have seen many threads with problems relating to android pie on this phone. Should I try and downgrade it back to android 8.1 or leave it on android pie?

What possible problems are there for the a2 lite on android pie?
[Xiaomi Mi A2 Lite Questions & Answers] ShadyTurtle334:
For 10.0.3.0 compilation, in my case;

*Lack of bluetooth audio streaming codecs (sbc only)

*Some problems with WiFi ipv6 only. Forced ipv4 works like a charm.

*Slower WiFi while Bluetooth/GPS is ON. Probably because everything is using 2.4GHz band.