[Android Automotive OS] M7mdrd1:
I searched for a few things on Chinese websites and I think this information is useful

( I don't own any rights all of them belong to JollyRogerII, I'm just sharing them)

I translate it with google translate (I strongly recommend having help from someone who knows Chinese and can read it for you)

(If you wanna do it PLEASE READ THE WHOLE ARTICLE)

第二代CS75Plus车机直装APP并ROOT教程(一)

本教程仅做技术研究交流，不可用做其他用途。 使用我提供的教程出任何问题我不负任何责任。 另外，请各位工具箱作者绕道，有点志气，别用我的东西。 工具箱用户更不推荐使用。 允许转载，请注明出处。 介绍及环境配置 1、介绍： 长安第二代CS75Plus 2022款车机全系采用联发科MT8666(Helio P70)的SOC，8G RAM，28G ROM，车机本身不能直接安装APP，但是可以用ADB连接车机，并且有带密码的Shell Root，教程以此为突破口。 直接安装APK的教程需要一台安卓手机(需要访问te

www.bilibili.com

(PART 1)

This tutorial is only for technical research and exchange, and cannot be used for other purposes.

I am not responsible for any problems with the tutorials I provide.

In addition, please detour the toolbox authors, have a little ambition, and don't use my things.

Not recommended for toolbox users.

Reprinting is allowed, please indicate the source.

Introduction and environment configuration

1 Introduction:

Changan’s second-generation CS75Plus 2022 models all use MediaTek MT8666 (Helio P70) SOC, 8G RAM, and 28G ROM. The car itself cannot directly install APP, but it can be connected to the car with ADB, and there is a Shell Root with a password. , the tutorial takes this as a breakthrough.

The tutorial of directly installing APK requires an Android phone (you need to access the data directory of termux, and the phone may need to have root permissions), install termux (version 0.118.0), MT manager or other file managers with text editing functions on the phone .

2. Termux environment installation:

After installing termux, enter the command:

pkg install android-tools

This step is to install adb and fastboot into the termux environment.

If the installation is unsuccessful, you need to change the pkg source of termux to the source in China, enter the command:

termux-change-repo, the following interface will appear:

Select Mirror group (the default option), press Enter, and the following interface will appear:

Use the arrow (↓) to select the All in China option (the option shown in the figure), press Enter, and the following interface will appear:

After waiting for the operation to complete, execute it again:

pkg install android-tools

After waiting for the operation to complete, enter the command: adb

If "No command adb found, did you mean:........" does not appear, the installation is successful.

3. The configuration required for the car and machine part

Open System Settings-Connection-Mobile Data-Hotspot, turn on the car-machine hotspot, set the name and password, and then connect the phone to the car-machine hotspot.

Enter the command in termux:

su switch to root user

ip neigh

192.168.xxx.xxx is the internal network ip when the car machine is used as a router, keep in mind.

If the mobile phone does not have root authority, you can try to enter the ip neigh command directly. If an error is reported, open the current Wi-Fi network details in the settings:

The router ip is the above ip. (The picture is randomly matched)

4. ADB connection car machine

Enter the command in termux:

adb connect 192.168.xxx.xxx (intranet ip just now)

If connected to 192.168.xxx.xxx:5555 is displayed, the connection is successful.

5. Turn off the vehicle partition detection

Before doing all operations, you need to turn off the /system partition detection. input the command:

adb root run adb as root user

adb disable-verity Turn off partition detection

adb reboot Restart the car and wait for the restart to complete

adb root

adb remount mount /system partition read and write

In each subsequent operation, you need to execute first:

adb root

adb remount

By now, you have mounted the /system partition as read-write. In the future, we will continue to modify the car machine on this basis, so that the car machine can bypass Weichen encryption and install APP directly.

If there are any omissions and mistakes, please correct me. Author: JollyRogerII https://www.bilibili.com/read/cv22428309?jump_opus=1 Source: bilibili

第二代CS75Plus装APP和ROOT教程(二)直装APP

本教程仅做技术研究交流，不可用做其他用途。 使用我提供的教程出任何问题我不负任何责任。 工具箱用户更不推荐使用。 允许转载，请注明作者。 另外，请各位工具箱作者绕道，有点志气，别用我的东西，比如林某华和余某[呵呵]。 二、直装APP 上一篇教程中我们解决了使用工具连接车机和去掉system分区验证的问题，本篇教程主要讲述如何在上篇文章的基础上直接安装APP的问题。 第二代CS75Plus车机采用为辰加密，若直接安装或shell pm install 会显示"xxx.xxx.xxx is not auth,

www.bilibili.com

(PART 2)

This tutorial is only for technical research and exchange, and cannot be used for other purposes.

I am not responsible for any problems with the tutorials I provide.

Not recommended for toolbox users.

Reprinting is allowed, please indicate the author.

In addition, please detour the toolbox authors, have a little ambition, and don't use my things, such as Lin Mouhua and Yu Mou [hehe].

2. Install APP directly

In the previous tutorial, we solved the problem of using tools to connect the car and remove the system partition verification. This tutorial mainly talks about how to install the APP directly on the basis of the previous article.

The second-generation CS75Plus car machine adopts Chen encryption. If it is installed directly or shell pm install, it will display "xxx.xxx.xxx is not auth, install failed!". There are two solutions in this case:

1. Bypass Weichen encryption and install directly, this way installs the app in the /data partition;

2. Unzip the app and so files to the app and lib folders in the /system partition and authorize them.

The second method is extremely cumbersome, so we use the first method here.

The tutorial is as follows:

1. Obtain the build.prop file and services.vdex file

After adb is connected to the car, termux enters the command:

adb pull /system/build.prop /sdcard

Pull the build.prop file in the /system directory of the car to the local /sdcard directory. This /sdcard directory can be modified to any path you want.

adb pull /system/framework/oat/arm64/services.vdex /sdcard

Pull the in-vehicle services.vdex file to the local /sdcard directory

2. Verify the services.vdex file

Long press the services.vdex file in the MT manager, select Properties - Verify

Copy the text below and click Paste to check whether the verification is passed

e852e0dfd25c39e5f9668160d02afb9d

If it passes, continue to operate, if not, please stop and contact me in the group.

3. Modify build.prop

Open the file manager, take MT manager as an example.

Find the build.prop file under the local/sdcard, open it in text form, and find

"ro.product.name=S311_MCA" line

Change it to "ro.product.name=xj8verified" and exit to save.

4. Update the car build.prop

termux input command:

adb root

adb remount

adb shell Enter the shell, you will be asked to enter a password, the password is adb369875

mv /system/build.prop /system/build.prop.bak

Back up the original build.prop file as build.prop.bak

(It is absolutely not allowed to turn off the car at this time, please start the engine in advance)

exit Exit the shell

adb push /sdcard/build.prop /system

Push the modified build.prop file in the local /sdcard directory to the vehicle/system directory.

adb shell

cd /system enters the /system directory

chmod 600 build.prop authorizes the file 600

ls -l build.prop checks file permissions, should show: -rw-------

reboot Restart the car

Not surprisingly, here you can freely install apps on your car, without being restricted by Weichen Encryption.

Installation method:

adb push + shell pm install (recommended)

adb install (not recommended)

Download root explorer, install it with re manager after adb push (strongly recommended)

As for the second solution above, let’s briefly mention it. The general steps are as follows:

Extract the .so file of your own SOC after decompressing the apk, copy it to /system/lib, authorize 644, create a new folder for the required application under the /system folder, authorize 755, copy the apk to this folder, and authorize 644. Restart the engine.

Apps installed using this scheme have the following disadvantages:

(1) The icon can be displayed and used only after the car is restarted. If a specific type of APP is installed, it may cause the infinite card logo on the next restart

(2) The operation is quite troublesome

(3) To uninstall the software, you need to manually delete the apk, folders, and so files

(4) Manual deletion will cause the situation that the .jks (certificate file) cannot be uninstalled

(5) Once partition verification needs to be enabled, there will be many files that need to be modified

Under normal circumstances, it is enough for us to use the first method to install the app to the /data partition. If you really need to install the app to the /system partition, it is recommended to use other apps to move to /system after rooting or use the second method. The only known app that requires the second method is ICCOA Carlink. And you need to modify the api whitelist when installing carlink. If there is a need in the future, we can make more tutorials.

Precautions:

1. It is forbidden to install APPs used to replace the system package installer, such as R-installation components or installation lion, etc. If you accidentally install it, please uninstall it immediately, otherwise it will freeze the next time you boot.

2. It is forbidden to install MT manager or NP manager with its own APP installation function. The RE manager can install some versions, and I will post the available versions to the group.

3. It is forbidden to install shizuku or shizuku-like APPs (such as sui). Please try not to install or use root working mode for apps that require shizuku authorization.

4. Try not to uninstall the APPs originally included in the system, such as Tencent Maps, iQunting, etc., which may cause the boot to freeze.

5. It is forbidden to use the adb enable-verity command, otherwise the card will boot. If you really need to enable partition verification, please restore the build.prop file and delete all changes made in /system or other partitions.

In this part of the tutorial, we have learned about the operation of the direct installation APP. In the next part of the tutorial, we will use this as a basis to perform Magisk Root and install LSPosed on the car.

If there are any omissions and mistakes, please criticize and correct! Author: JollyRogerII https://www.bilibili.com/read/cv22468629?jump_opus=1 Source: bilibili