Switch dongle from "factory" to "android based"? about wireless-carplay-dongle-reverse-engineering

[milesking]

I was trying to turn my android version dongle to this one use /usr/sbin/fakeiOSDevice. I did a lot of research on the autokit apk. I think most core codes hide behind binaries, which could never be reversed. For your issue, you can check the dongle's vid and pid. Cause in the apk /res/xml/device_filter.xml it allows vendor-id="4884" product-id="5408".

By the way, the android dongle update image encryption differs from U2W one. I could not reverse-engineer the Auto_Box_Update.img.

[jsm174]

@milesking Sorry for the late reply. Funny, I did try to mess around with the vendor and product, but I couldn't get the tablet to do anything.

I think the flow is:

wireless-carplay-dongle-reverse-engineering/Extracted/28102020/etc/init.d/rcS

Line 27 in e7f29ef

/script/start_main_service.sh &

wireless-carplay-dongle-reverse-engineering/Extracted/28102020/script/start_main_service.sh

Line 73 in e7f29ef

/script/start_iap2_ncm.sh

wireless-carplay-dongle-reverse-engineering/Extracted/28102020/script/start_iap2_ncm.sh

Lines 16 to 17 in e7f29ef

	echo 08e4 > /sys/class/android_usb/android0/idVendor
	echo 01c0 > /sys/class/android_usb/android0/idProduct

I've read some docs that say vendor and product id in the xml must be represented as integers vendor-id="4884" product-id="5408". Since these values when encoded to hex don't have any letters, I'm not sure what the echo lines should be. So I tried both:

echo 1314 > /sys/class/android_usb/android0/idVendor
echo 1520 > /sys/class/android_usb/android0/idProduct

echo 4884 > /sys/class/android_usb/android0/idVendor
echo 5408 > /sys/class/android_usb/android0/idProduct

After I posted this issue, I decided to order one on ebay. Unfortunately, it appears to be lost.

Anyway, when it arrives, I "think" I know how U2W_Decrypt.php was figured out. If I'm right, I'll keep you posted.

[milesking]

Waiting for your good news. As for the U2W one, I guess there comes the license issue even if you figured out the vid/pid issue.
I used the android variant for 3 months, it's stable and reliable but not perfect. Like, it could not recognize night mode when you turn on the headlight, the audio channel messed music and nav.

[jsm174]

Following up.. Unfortunately no good news. I think my wanna-be reverse engineer-er days might be over. 😃

I finally received the Carlinkit today. I tried it out on the Android tablet and it worked well. I then tried to dump the 25L12835F and I think it self destructed.

The blue led started flashing bright and fast on the board, then eventually stopped and went to a faint blue glow. It is totally dead. The dump seems valid up to 0x01F3458, but well before the jffs2 file system.

sudo flashrom -p ch341a_spi -c "MX25L12835F/MX25L12845E/MX25L12865E" -V -r rom_new.bin
flashrom v1.2 on Darwin 20.1.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

flashrom was built with LLVM Clang 12.0.0 (clang-1200.0.32.27), little endian
Command line (7 args): flashrom -p ch341a_spi -c MX25L12835F/MX25L12845E/MX25L12865E -V -r rom_new.bin
Calibrating delay loop... OS timer resolution is 1 usecs, 2855M loops per second, 10 myus = 9 us, 100 myus = 132 us, 1000 myus = 1054 us, 10000 myus = 10190 us, 4 myus = 4 us, OK.
Initializing ch341a_spi programmer
libusb: info [darwin_claim_interface] no interface found; setting configuration: 1
Device revision is 3.0.4
The following protocols are supported: SPI.
Probing for Macronix MX25L12835F/MX25L12845E/MX25L12865E, 16384 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2018
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on ch341a_spi.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Block Protect 3 (BP3) is not set
Chip status register: Block Protect 2 (BP2) is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
This chip may contain one-time programmable memory. flashrom cannot read
and may never be able to write it, hence it may not be able to completely
clone the contents of this chip (see man page for details).
Reading flash... done.

[milesking]

Eventually, I bought the U2W dongle. Did not find any clue getting into the filesystem.

[jsm174]

@ludwig-v On my working unit, I removed /usr/sbin/fakeiOSDevice hoping it would fall through the script and execute ARMadb-driver. Since that ultimately didn't work, I tried to put the file back.

Unfortunately, every time the device reboots, the filesystem is reverted and /usr/sbin/fakeiOSDevice is gone.

Have you seen this behavior before?

[ludwig-v]

the filesystem is reverted

What do you mean by reverted ?
Don't forget to "sync" if you copy back a file on filesystem

[jsm174]

@ludwig-v Sorry, should have been more clear, spent like 6 hours on it last night.

Basically it's like sync is no longer working.

• Connect to wifi

➜  ~ ssh -v -i ~/.ssh/cplay2air [email protected]
OpenSSH_8.1p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: Connecting to 192.168.50.2 [192.168.50.2] port 22.
debug1: connect to address 192.168.50.2 port 22: Connection refused
ssh: connect to host 192.168.50.2 port 22: Connection refused

• Insert USB

➜  ~ ssh -v -i ~/.ssh/cplay2air [email protected]
OpenSSH_8.1p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: Connecting to 192.168.50.2 [192.168.50.2] port 22.
debug1: Connection established.
debug1: identity file /Users/jmillard/.ssh/cplay2air type 0
debug1: identity file /Users/jmillard/.ssh/cplay2air-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version dropbear_2020.81
.
.

• Change to script directory

[(\t)\u@\w]#cd /script/
[(\t)\u@\w]#ls
after_shutdown.sh        load_bluetooth_wifi.sh   reset_usb_bus.sh         start_hnp.sh             up_apple_net.sh
check_update.sh          mount-LJ.sh              set_wm8960_mix.sh        start_iap2_ncm.sh        update_box.sh
close_bluetooth_wifi.sh  mount-SK.sh              set_wm8978_mix.sh        start_iphone.sh          update_box_ota.sh
copy_to_tmp.sh           mount-TF.sh              smart_copy.sh            start_main_service.sh    update_dtb.sh
goto_burn_mode.sh        mount-UPAN.sh            start_accessory.sh       start_mass_storage.sh    update_kernel.sh
init_bluetooth_wifi.sh   mount-gadgetfs.sh        start_accessory_bak.sh   start_mic_record.sh
init_gpio.sh             open_log.sh              start_aoa.sh             start_ncm.sh
ko.tar.gz                quickly_update.sh        start_bluetooth_wifi.sh  test_mic.sh

• Remove start_accessory.sh and rename start_accessory_bak.sh

[(\t)\u@\w]#rm start_accessory.sh
[(\t)\u@\w]#sync
[(\t)\u@\w]#mv start_accessory_bak.sh start_accessory.sh
[(\t)\u@\w]#sync
[(\t)\u@\w]#ls
after_shutdown.sh        load_bluetooth_wifi.sh   reset_usb_bus.sh         start_iap2_ncm.sh        update_box.sh
check_update.sh          mount-LJ.sh              set_wm8960_mix.sh        start_iphone.sh          update_box_ota.sh
close_bluetooth_wifi.sh  mount-SK.sh              set_wm8978_mix.sh        start_main_service.sh    update_dtb.sh
copy_to_tmp.sh           mount-TF.sh              smart_copy.sh            start_mass_storage.sh    update_kernel.sh
goto_burn_mode.sh        mount-UPAN.sh            start_accessory.sh       start_mic_record.sh
init_bluetooth_wifi.sh   mount-gadgetfs.sh        start_aoa.sh             start_ncm.sh
init_gpio.sh             open_log.sh              start_bluetooth_wifi.sh  test_mic.sh
ko.tar.gz                quickly_update.sh        start_hnp.sh             up_apple_net.sh

• Reboot

[(\t)\u@\w]#/sbin/reboot
[(\t)\u@\w]#client_loop: send disconnect: Broken pipe

• Connect to wifi, log back in, list script folder:

[(\t)\u@\w]#cd /script/
[(\t)\u@\w]#ls
after_shutdown.sh        load_bluetooth_wifi.sh   reset_usb_bus.sh         start_hnp.sh             up_apple_net.sh
check_update.sh          mount-LJ.sh              set_wm8960_mix.sh        start_iap2_ncm.sh        update_box.sh
close_bluetooth_wifi.sh  mount-SK.sh              set_wm8978_mix.sh        start_iphone.sh          update_box_ota.sh
copy_to_tmp.sh           mount-TF.sh              smart_copy.sh            start_main_service.sh    update_dtb.sh
goto_burn_mode.sh        mount-UPAN.sh            start_accessory.sh       start_mass_storage.sh    update_kernel.sh
init_bluetooth_wifi.sh   mount-gadgetfs.sh        start_accessory_bak.sh   start_mic_record.sh
init_gpio.sh             open_log.sh              start_aoa.sh             start_ncm.sh
ko.tar.gz                quickly_update.sh        start_bluetooth_wifi.sh  test_mic.sh

I tried scripting the same process via U2W.sh instead of ssh. I tried updates. It's like the file system is stuck at the 2020.11.10 release.

[jsm174]

So I played some more and even tried to run the update manually.

I noticed in your update logs, you have:

upgradeItemFlashWrite off:2048 len:1024
upgradeItemFlashWrite off:3072 len:1024
upgradeItemFlashWrite off:4096 len:192512
upgradeItemFlashWrite off:262144 len:65536
upgradeItemFlashWrite off:1572864 len:65536
upgradeItemFlashWrite off:2228224 len:65536
upgradeItemFlashWrite off:196608 len:65536
upgrade successfully
End upg

Mine is definitely not doing that at the end:

./
./lib/
./lib/.delete
./lib/firmware/
./lib/firmware/rtl8822b_fw
./lib/firmware/rtl8822b_config
./lib/firmware/rtlbt/
./lib/firmware/rtlbt/rtl8822b_fw
./lib/firmware/rtlbt/rtl8822b_config
./script/
./script/start_mass_storage.sh
./script/init_gpio.sh
./script/check_update.sh
./script/start_accessory.sh
./script/init_bluetooth_wifi.sh
./script/update_box.sh
./script/start_aoa.sh
./script/close_bluetooth_wifi.sh
./script/copy_to_tmp.sh
./script/.delete
./script/start_main_service.sh
./script/ko.tar.gz
./script/update_box_ota.sh
./script/open_log.sh
./script/after_shutdown.sh
./script/start_iap2_ncm.sh
./script/start_bluetooth_wifi.sh
./script/quickly_update.sh
./usr/
./usr/lib/
./usr/lib/libARMtool.so
./usr/lib/.delete
./usr/lib/libdns_sd.so
./usr/sbin/
./usr/sbin/set_wifi_mac
./usr/sbin/usbmuxd
./usr/sbin/ui.tar.gz
./usr/sbin/bluetoothDaemonTest
./usr/sbin/boa
./usr/sbin/rtk_hciattach
./usr/sbin/ARMadb-driver
./usr/sbin/dbus-daemon
./usr/sbin/mdnsd
./usr/sbin/hostapd
./usr/sbin/bluetoothDaemon
./usr/sbin/hcid
./usr/sbin/AppleCarPlay
./usr/sbin/fakeiOSDevice
./usr/sbin/.delete
./usr/sbin/ARMiPhoneIAP2
./tmp/
./tmp/AutoBox.img
./tmp/upg
./tmp/once.sh
./etc/
./etc/udhcpd.conf
./etc/dbus-1/
./etc/dbus-1/system.conf
./etc/dbus-1/system.d/
./etc/dbus-1/system.d/bluetooth.conf
./etc/dbus-1/system.d/riddle.conf
./etc/dbus-1/session.conf
./etc/inittab
./etc/boa/
./etc/boa/www/
./etc/boa/www/lang.js
./etc/boa/www/index.html
./etc/boa/www/skin.css
./etc/boa/boa.conf
./etc/boa/cgi-bin/
./etc/boa/cgi-bin/server.cgi
./etc/boa/cgi-bin/upload.cgi
./etc/hostapd.conf
./etc/box_product_type
./etc/init.d/
./etc/init.d/rcS
./etc/profile
./etc/bluetooth/
./etc/bluetooth/rfcomm.conf
./etc/bluetooth/eir_info
./etc/bluetooth/hcid.conf
./etc/mdev/
./etc/mdev/udisk_insert.sh
./etc/mdev/udisk_remove.sh
./etc/mdev/udisk_hotplug.sh
./etc/box_version
./etc/software_version
rm: can't remove '/usr/lib/libjpeg*': No such file or directory
rm: can't remove '/usr/lib/libturbojpeg*': No such file or directory
Start upg
AnalyseProcess mdnsd processID=98
mdnsd still running, count=10
Current System: 
 supportCpu?:true software_version:2020.11.06.0001
� memory(use:34116k free:89316k)
mtd /dev/mtd0: size(262144k) erasesize(65536k)
mtd /dev/mtd1: size(6029312k) erasesize(65536k)
mtd /dev/mtd2: size(10485760k) erasesize(65536k)
GenCryptEnv 成功 
Analyse Start!
升级文件 filePathToCover:/lib/.delete fileName:.delete thisFile:/tmp/update/lib/.delete
升级文件 filePathToCover:/script/.delete fileName:.delete thisFile:/tmp/update/script/.delete
升级文件 filePathToCover:/usr/lib/.delete fileName:.delete thisFile:/tmp/update/usr/lib/.delete
升级文件 filePathToCover:/usr/sbin/.delete fileName:.delete thisFile:/tmp/update/usr/sbin/.delete
/tmp/update/etc/bluetooth/eir_info to /etc/bluetooth/eir_info orgsize:0 newsize:95 
/tmp/update/etc/bluetooth/hcid.conf to /etc/bluetooth/hcid.conf orgsize:0 newsize:1234 
/tmp/update/etc/boa/boa.conf to /etc/boa/boa.conf orgsize:9999 newsize:9999 
/tmp/update/etc/boa/cgi-bin/server.cgi to /etc/boa/cgi-bin/server.cgi orgsize:23480 newsize:17384 
/tmp/update/etc/boa/cgi-bin/upload.cgi to /etc/boa/cgi-bin/upload.cgi orgsize:13772 newsize:13772 
/tmp/update/etc/boa/www/index.html to /etc/boa/www/index.html orgsize:5813 newsize:7419 
/tmp/update/etc/boa/www/lang.js to /etc/boa/www/lang.js orgsize:56035 newsize:59019 
/tmp/update/etc/boa/www/skin.css to /etc/boa/www/skin.css orgsize:7460 newsize:7460 
/tmp/update/etc/hostapd.conf to /etc/hostapd.conf orgsize:950 newsize:958 
/tmp/update/etc/mdev/udisk_hotplug.sh to /etc/mdev/udisk_hotplug.sh orgsize:987 newsize:987 
/tmp/update/etc/mdev/udisk_insert.sh to /etc/mdev/udisk_insert.sh orgsize:495 newsize:495 
/tmp/update/etc/mdev/udisk_remove.sh to /etc/mdev/udisk_remove.sh orgsize:636 newsize:636 
/tmp/update/etc/software_version to /etc/software_version orgsize:16 newsize:15 
/tmp/update/lib/firmware/rtl8822b_config to /lib/firmware/rtl8822b_config orgsize:0 newsize:0 
/tmp/update/lib/firmware/rtl8822b_fw to /lib/firmware/rtl8822b_fw orgsize:0 newsize:0 
/tmp/update/lib/firmware/rtlbt/rtl8822b_config to /lib/firmware/rtlbt/rtl8822b_config orgsize:2 newsize:2 
/tmp/update/lib/firmware/rtlbt/rtl8822b_fw to /lib/firmware/rtlbt/rtl8822b_fw orgsize:45148 newsize:45148 
/tmp/update/script/after_shutdown.sh to /script/after_shutdown.sh orgsize:789 newsize:902 
/tmp/update/script/close_bluetooth_wifi.sh to /script/close_bluetooth_wifi.sh orgsize:752 newsize:786 
/tmp/update/script/init_bluetooth_wifi.sh to /script/init_bluetooth_wifi.sh orgsize:466 newsize:1423 
/tmp/update/script/ko.tar.gz to /script/ko.tar.gz orgsize:1055657 newsize:1055913 
/tmp/update/script/start_accessory.sh to /script/start_accessory.sh orgsize:704 newsize:972 
/tmp/update/script/start_iap2_ncm.sh to /script/start_iap2_ncm.sh orgsize:963 newsize:854 
/tmp/update/script/start_main_service.sh to /script/start_main_service.sh orgsize:2193 newsize:2505 
/tmp/update/usr/sbin/ARMadb-driver to /usr/sbin/ARMadb-driver orgsize:219176 newsize:219604 
/tmp/update/usr/sbin/ARMiPhoneIAP2 to /usr/sbin/ARMiPhoneIAP2 orgsize:158668 newsize:159028 
/tmp/update/usr/sbin/AppleCarPlay to /usr/sbin/AppleCarPlay orgsize:295136 newsize:294752 
/tmp/update/usr/sbin/bluetoothDaemon to /usr/sbin/bluetoothDaemon orgsize:138292 newsize:138292 
/usr/sbin/bluetoothDaemonTest InMyList /usr/sbin/.delete
/tmp/update/usr/sbin/bluetoothDaemonTest to /usr/sbin/bluetoothDaemonTest orgsize:0 newsize:103640 
AnalyseProcess boa processID=111
/tmp/update/usr/sbin/fakeiOSDevice to /usr/sbin/fakeiOSDevice orgsize:0 newsize:1042236 
/tmp/update/usr/sbin/rtk_hciattach to /usr/sbin/rtk_hciattach orgsize:22120 newsize:21548 
/tmp/update/usr/sbin/ui.tar.gz to /usr/sbin/ui.tar.gz orgsize:258572 newsize:266589 
/usr/sbin/usbmuxd InMyList /usr/sbin/.delete
/tmp/update/usr/sbin/usbmuxd to /usr/sbin/usbmuxd orgsize:0 newsize:40300 
eir_info need 95 more, neednow: 95 
hcid.conf need 1234 more, neednow: 1329 
boa.conf need 0 more, neednow: 1329 
server.cgi need -6096 more, neednow: -4767 
upload.cgi need 0 more, neednow: -4767 
index.html need 1606 more, neednow: -3161 
lang.js need 2984 more, neednow: -177 
skin.css need 0 more, neednow: -177 
hostapd.conf need 8 more, neednow: -169 
udisk_hotplug.sh need 0 more, neednow: -169 
udisk_insert.sh need 0 more, neednow: -169 
udisk_remove.sh need 0 more, neednow: -169 
software_version need -1 more, neednow: -170 
rtl8822b_config need 0 more, neednow: -170 
rtl8822b_fw need 0 more, neednow: -170 
rtl8822b_config need 0 more, neednow: -170 
rtl8822b_fw need 0 more, neednow: -170 
after_shutdown.sh need 113 more, neednow: -57 
close_bluetooth_wifi.sh need 34 more, neednow: -23 
init_bluetooth_wifi.sh need 957 more, neednow: 934 
ko.tar.gz need 256 more, neednow: 1190 
start_accessory.sh need 268 more, neednow: 1458 
start_iap2_ncm.sh need -109 more, neednow: 1349 
start_main_service.sh need 312 more, neednow: 1661 
ARMadb-driver need 428 more, neednow: 2089 
ARMiPhoneIAP2 need 360 more, neednow: 2449 
AppleCarPlay need -384 more, neednow: 2065 
bluetoothDaemon need 0 more, neednow: 2065 
bluetoothDaemonTest need 103640 more, neednow: 105705 
fakeiOSDevice need 1042236 more, neednow: 1147941 
rtk_hciattach need -572 more, neednow: 1147369 
ui.tar.gz need 8017 more, neednow: 1155386 
usbmuxd need 40300 more, neednow: 1195686 
.delete need 0 more, neednow: 1195686 
.delete need 0 more, neednow: 1195686 
.delete need 0 more, neednow: 1195686 
.delete need 0 more, neednow: 1195686 
mayNeedMoreFlashSpaceSize=1195686 minFlashSizeReserve=204800 freeSpace=1887436
AppUpdate May need more flash space: 1195686
key here
key here
key here
replace setenv bootargs console=ttyLogFile0 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=21e0000.qspi:256k(uboot),3328K(kernel),12800K(rootfs) rootwait quiet rw  to setenv bootargs console=ttyLogFile0 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=21e0000.qspi:256k(uboot),5888K(kernel),10240K(rootfs) rootwait quiet rw 
 154 to 154
key here
mayConsumTime: 0S
delete /lib/libasan.so.1.0.0
delete /lib/libubsan.so.0.0.0
delete /script/cdc_ncm.ko
delete /script/f_ptp.ko
delete /script/g_iphone.ko
delete /usr/lib/libssl.so.1.0.0
delete /usr/lib/libssl.so
delete /usr/lib/liblzo2.so
delete /usr/lib/liblzo2.so.2
delete /usr/lib/libavcodec.so
delete /usr/lib/libavcodec.so.56
delete /usr/lib/libavcodec.so.56.26.100
delete /usr/lib/libavformat.so
delete /usr/lib/libavformat.so.56
delete /usr/lib/libavformat.so.56.25.101
delete /usr/lib/libavutil.so
delete /usr/lib/libavutil.so.54
delete /usr/lib/libavutil.so.54.20.100
delete /usr/lib/libswresample.so
delete /usr/lib/libswresample.so.1
delete /usr/lib/libswresample.so.1.1.100
delete /usr/sbin/adb
delete /usr/sbin/carlife
delete /usr/sbin/usbmuxd
delete /usr/sbin/sdptool
delete /usr/sbin/bluetoothDaemonTest
创建 /lib/firmware/ 文件夹 后 覆盖 /tmp/update/lib/firmware/rtl8822b_fw to /lib/firmware/rtl8822b_fw 完成
创建 /lib/firmware/ 文件夹 后 覆盖 /tmp/update/lib/firmware/rtl8822b_config to /lib/firmware/rtl8822b_config 完成
创建 /lib/firmware/rtlbt/ 文件夹 后 覆盖 /tmp/update/lib/firmware/rtlbt/rtl8822b_config to /lib/firmware/rtlbt/rtl8822b_config 完成
创建 /etc/ 文件夹 后 覆盖 /tmp/update/etc/software_version to /etc/software_version 完成
删除旧文件 /etc/bluetooth/eir_info 可能失败。 但是可能不影响
复制文件 /tmp/update/etc/bluetooth/eir_info 失败
End upg

[ludwig-v]

Closing as this is not an issue, just opened "Discussions" tab here: https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/discussions