Unable to rollback/upgrade to CFW about wireless-carplay-dongle-reverse-engineering

[jailbird777]

I might have the same (or similar) issue. 3.0 CarlinkIT from a few months ago was running custom and I bricked it trying to upgrade it somehow. I'm trying to find my SOIC-8 clips to revive it, but I figured I could use a spare anyways, so I ordered another one. They were backordered and it just came in, I believe it came with 2021.07.05.2319 on it (at least that's what is listed as the rollback option, I hadn't even used it before I tried customizing it).

I couldn't get it to take either U2W_Update_2020.11.10.2138_ROLLBACK.img nor U2W_AUTOKIT_Update_2020.12.25.1732_ROLLBACK.img no matter what I named them. I'd plug the USB thumb stick into the unit when it was sitting at the red LED, and it would just flash the thumb stick for a second and that's it.

It took U2W_AUTOKIT_Update_2021.08.24.1817.img just fine, however, if I renamed it to U2W_AUTOKIT_Update.img . I'm wondering if they did something on these newer units in order to make it not downgradeable?

[dmavromatis]

I also have reported the same exact issue:

#110

and

#111

@ludwig-v let me know if you need any more data from us.

Thanks!

[dmavromatis]

@jailbird777 yes, that sounds inline with what we are experiencing with v3.0 devices.

[abbottnetworks]

That's my thought, there's something on the newer hardware that is doing a verification/check on the firmware.. I'm thinking the older firmware might be missing something, or incomparable in some way; so it's not actually flashing it... There's no way it's flashing the full file in just a few seconds... without any indication; just the web GUI being updated with a new string.

[dmavromatis]

@ludwig-v any thoughts on this? Let me know if you need a V3.0 device, so you can test yourself.

[ludwig-v]

No software solutions until the new encryption is broke, as you told U2W_AUTOKIT_Update_2020.12.25.1732 is resulting in 2020.12.25.1733 on V3 devices : this is suggesting the proprietary update binary is not replacing the encryption binary by the old one (since you can install new versions right away) and change the version number

Hardware solution: directly write the flash. I can make a dump from latest CFW that would work on V3 devices (>= 2021.03.06)

[dmavromatis]

Hardware solution: directly write the flash. I can make a dump from latest CFW that would work on V3 devices (>= 2021.03.06)

@ludwig-v yes, please dump a CFW BIN I can flash directly -- ideally the CFW 2021.08.24 version.

FYI: I successfully was able to directly flash a bricked v2 unit and recovered it... so I'm ready to try to directly flash a V3.0 unit.

Update: I tried to dump V2 CFW 2021.08.24 to BIN and flash V3 unit but it didn't work... I get a "Hardware Error: Wi-Fi BT". It's running the CFW, just giving me the Wi-Fi error... Let me know if that should work or if you need to dump a special version that works on V3 devices. You can provide either a U2W.sh script that copies the correct wifi-bt drivers or a complete BIN.

[abbottnetworks]

If there's anything I can do to help, let me know. I'd be happy to test the hardware solution as well, that said I'm not sure what is involved with writing directly to the flash. Anything special with that process?

[dmavromatis]

It's actually fairly straight forward... just order a CH341 programmer ($11 on Amazon) and ASProgrammer (using 1.4.1) and you clip the programmer on the chip and read/write the BIN files (see: #72). I recovered a V2... which was awesome.

Now, just trying to get the CFW directly flashed on the V3, but it looks like just dumping a working CFW on a V2 isn't enough... since the V2 is using the RTL drivers and not the BCM.

So I think @ludwig-v needs to create a V3 compatible BIN for direct flashing...

[qdk0901]

@ludwig-v ,hi, do you have an Autokit flash dump?

[dmavromatis]

@ludwig-v hello?

[ludwig-v]

Sorry for the delay, had to buy a V3 to be sure.

"Rooted" my V3 the hard way: enjoy 🍿

[dmavromatis]

thanks! Flashed it -- works good so far!

[ludwig-v]

Activation : 192.168.50.2 on your phone, wait few seconds, activation success on screen, unplug & replug & done ;)

[dmavromatis]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

[qdk0901]

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

[ludwig-v]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

As far as you don't go back to original: by USB

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

Never really looked into this carefully (because it worked 🤟), I observed like you that it was doing something after the flash and that it could fail on different scenarios. Something sure is that eFUSEs are not burned with flash dumping

[mrmidnight273]

I'm having the issue as well with trying to install CFW on my V3. I've rolled back, I've rolled forward then back, and I am unable to flash my V3 with CFW. Any ideas, tips, or just wait?

[Converseallstar95]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

As far as you don't go back to original: by USB

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

Never really looked into this carefully (because it worked 🤟), I observed like you that it was doing something after the flash and that it could fail on different scenarios. Something sure is that eFUSEs are not burned with flash dumping

I just flashed my bricked v3 with your CFW dump and it programmed successfully; however, when plug it into my car, it shows the activation screen but the SSID never broadcasts for me to activate it. I've tried reprogramming twice now. Any ideas?

I can update to the stock AUTOKIT firmware by USB and then the SSID broadcasts, but then I am no longer on CFW, since v3 can't be flashed to CFW by USB right?

Edit:
After I program the CFW bin, I updated to the Aug update through USB, then Dec, then Jan through OTA, so I am no longer on CFW; however, the Jan update brought a whole new web interface with more options. You can change the SSID and Bluetooth name, see connected devices (your phone named "Lud" was in the paired list) and more. There was also an option to uncheck logs from the settings menu in the hedunit (before it connects to your iPhone) as well.

Looking forward to a CFW of the Jan update with the Carplay theme to manually program :)

[Igor888991]

Guys, it's possible make the CP2A work on a Aftermarket display? My dongle turn on a red light when I plug it, but show me nothing but an eternal "loading".