AdamOutler

Due to contractual obligations, I did nothing. I watched. I like watching.

I'd like to see all of the posts on this page and a few on the previous page, just disappear.

 

As for the thread.. Prepare yourselves for some huge news from bass_rock, whatisbypass and myself soon.

 

 

 

Great news, I found my SD Card password and found possibility to change all BSP settings, there is dump from my NOR flash:

This 16 digits is a serial number of your SD..,but not the pass.,the pass. must be 8 digits.

Heh, they probably made the password a checksum of the serial.

@AdamOutler what about iGo licenses? iGo in your "new" device is still working? Or licenses are invalid now? There is no maps now? As your firmware does not contain maps for iGo. How your EXTDATA partition is created without actual maps and data in firmware from pioneer?

 

If iGo is working but without maps, is it possible to update or upload free maps via naviextras? "First gps fix time" is changed to "now" or still older time? Can we "reset" iGo inserting new SD to update maps (free 45-day period after first gps fix)?

 

Can you now insert your old SD card into device, is it working or shows invalid password now?

 

 

What, like this?

Oh yeah!  My AVIC-8100NEX works!

 

I managed to get it to copy by simply sticking the new SDCard into my deck and letting it boot.  It booted right into Android and brought up the selection screens!  

 

 

After I rebooted using key 1, it went into this mode where i wrote the programs.

 

 

But.. I wrote the programs to a new SDCard.. 80X. 

 

The darn thing boots in 10 seconds now!  and works great in Android Auto!

 

It lives again!

According to sources it is possible to change/remove SD card password setting in NOR flash using U-Boot console command:

	"bsp passwd  <passwd> - set sd card password (16bytes)\n"

So all we need is access to console

 

Also it is possible to get password using JTAG or SDCard sniffer/logic analyzer

 

@Lucca is this SN linked to iGo device.nng and/or licenses?

I will be doing that soon.  

 

Tell me, are there any commands that allow memory read in U-Boot?  U-Boot has the ability to get through many memory protections which it emplaces.  If anything can read the password from inside the device it's U-Boot.   I forget the commands, but I believe it was two letters, then two parameters for offset and length..

 

yep.. just found it.  http://www.denx.de/wiki/publish/DULG/to-delete/UBootCmdGroupMemory.html 

 

The command is "md".  Is that in the u-boot sources we are working with?

I'm not exactly sure...,but it seems that the S.N. of your original SDCard is 74020007D6

Ok. Does that need to be accounted for/encoded, on the new image?

I'm totally confused. Can you take a new blank 16gb sd card, record the data on it back using dd command and your fullsd.img file and insert this cart into internal slot of device? Is this method is not working? Or you need to set correct password for this new sd? Device rejecting unknown cards? Why are you trying to use testmode's copy device capability?

I wanted to save the extra SDCard if possible. The SDCard is expensive (80x SDCard).

 

The SDCard password is set by the deck according to bass_rock's similar experiment. This renders the SDCard unusable after power on, because we don't know the password.

Have you tried to insert duplicated sd card into internal slot?

 

Have you tried this? http://avic411.com/index.php?/topic/80945-upgrading-nex4000-to-nex4100-work-in-progress/?p=333868

Key 1 just sits at software error. Key 2 copies the SDCard. Just to verify, key 2 copies TO internal SD, not from, correct?

Ok.  I got the full SDCard image from my AVIC-8100NEX deck.  You can find it here https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F8100%2F.  I verified the sha256sum after upload.

root@adamoutler-desktop:/var/www/html/sd# sha256sum ./fullsd.img.gz 
e5682db410963d0b57b5eec94f3aa66eb9ae078ffeb1dc3ec4c02c0b7f426da6  ./fullsd.img.gz

This file and the others which are required to enter testmode and obtain this image were included.  Place them on a USB stick, insert into USB1 port to reboot into test mode, then use the write program forcedly>Copy Script option to recreate.

 

This image came from my deck and is unsanitized.  

 

I copied it to my other 8100, with testmode_N.key (2), in hopes I could bring it back to life, but I got the "Software Error" screen.   

I have tested USB-UART devices (FT232RL and CP2102) and USB-Ethernet adapter:

<7>[  155.086565] ehci_fsl_bus_resume begins, Host 1
<7>[  155.098306] ehci_fsl_bus_resume ends, Host 1
<6>[  155.358341] usb 2-1: new full speed USB device number 3 using fsl-ehci
<6>[  161.273178] usb 2-1: USB disconnect, device number 3
<7>[  163.498318] ehci_fsl_bus_suspend begins, Host 1
<7>[  163.498395] ehci_fsl_bus_suspend ends, Host 1
<7>[  167.296746] ehci_fsl_bus_resume begins, Host 1
<7>[  167.308316] ehci_fsl_bus_resume ends, Host 1
<6>[  167.558301] usb 2-1: new full speed USB device number 4 using fsl-ehci
<6>[  170.422095] usb 2-1: USB disconnect, device number 4
<7>[  172.618383] ehci_fsl_bus_suspend begins, Host 1
<7>[  172.618550] ehci_fsl_bus_suspend ends, Host 1
<7>[  202.275666] ehci_fsl_bus_resume begins, Host 1
<7>[  202.288316] ehci_fsl_bus_resume ends, Host 1
<6>[  202.548341] usb 2-1: new full speed USB device number 5 using fsl-ehci
<6>[  208.890184] usb 2-1: USB disconnect, device number 5
<7>[  211.428366] ehci_fsl_bus_suspend begins, Host 1
<7>[  211.428462] ehci_fsl_bus_suspend ends, Host 1
<7>[  223.007508] ehci_fsl_bus_resume begins, Host 1
<7>[  223.018323] ehci_fsl_bus_resume ends, Host 1
<6>[  223.268310] usb 2-1: new high speed USB device number 6 using fsl-ehci
<6>[  230.009255] usb 2-1: USB disconnect, device number 6
<7>[  232.428337] ehci_fsl_bus_suspend begins, Host 1
<7>[  232.428364] ehci_fsl_bus_suspend ends, Host 1
<6>[  246.524370] usb 1-1: USB disconnect, device number 2
<7>[  249.468365] ehci_fsl_bus_suspend begins, DR
<7>[  249.468670] ehci_fsl_bus_suspend ends, DR
<7>[  251.608627] ehci_fsl_bus_resume begins, DR
<7>[  251.628292] ehci_fsl_bus_resume ends, DR
<6>[  251.878310] usb 1-1: new full speed USB device number 3 using fsl-ehci
<3>[  252.034812] usb 1-1: device v10c4 pea60 is not supported
<6>[  255.825946] usb 1-1: USB disconnect, device number 3
<7>[  258.428354] ehci_fsl_bus_suspend begins, DR
<7>[  258.428672] ehci_fsl_bus_suspend ends, DR
<7>[  262.078712] ehci_fsl_bus_resume begins, DR
<7>[  262.098319] ehci_fsl_bus_resume ends, DR
<6>[  262.348311] usb 1-1: new high speed USB device number 4 using fsl-ehci
<3>[  262.512100] usb 1-1: device v0b95 p772b is not supported
<6>[  265.213849] usb 1-1: USB disconnect, device number 4
<7>[  267.428406] ehci_fsl_bus_suspend begins, DR
<7>[  267.428841] ehci_fsl_bus_suspend ends, DR
<7>[  269.338706] ehci_fsl_bus_resume begins, DR
<7>[  269.358322] ehci_fsl_bus_resume ends, DR

VID 10c4 PID ea60 from CP2102

VID 0b95 PID 772b from ASIX ethernet adapter

Looks like this devices has no drivers.

 

But there is no "not supported" line for FT232RL USB-UART adapter. So it supported or I do something wrong?

 

Also I have tried to change USB OTG ID to HIGH. After this change device reboots and USB Host/Function field of USB1 (device calls USB1 = Port1 and USB2 = Port0) is changed from USB Host to USB Function. After this change, USB1 is working like slave device, it is not possible to insert and use USB-flash in this USB1. I think this can help finding USB ADB, but I do not unserstand how to connect, for example, my laptop (I need USB-male<>USB-male cable?). Also maybe I need to change debug serial setting to ON (default is OFF). update: there is not very clear scheme of work, you should select port number (0 = USB2, 1 = USB1) in submenu and then use other menus of USB test.

 

Also I have tried to change product information. (Write product information (manual) menu). It is possible to change long 16-digit number (something like serial), but I think this product info is not affects iGo license. I changed last digit from 2 to 3 and reboot device. iGo software ID's isn't changed, licenses still working, so I revert this digit back to 2.

 

 

Using copy_script.sh, get the output of 'netcfg' before and after the usb device is connected.   if that doesn't work, check "ifconfig eth0", "ifconfig usb0", and "ifconfig wlan0", then change the 0's to 1s

I got the image from the deck.  Attached is a picture.

adamoutler@adamoutler-desktop:~/Desktop/Untitled Folder 3$ fdisk -l ./fullsd.img 
 
Disk ./fullsd.img: 16.1 GB, 16130244608 bytes
128 heads, 16 sectors/track, 15383 cylinders, total 31504384 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000
 
       Device Boot      Start         End      Blocks   Id  System
./fullsd.img1         1050624     1071103       10240   83  Linux
./fullsd.img2         1071104     1091583       10240   83  Linux
./fullsd.img3         1091584     3573759     1241088    5  Extended
./fullsd.img4         3573760    30197759    13312000   83  Linux
./fullsd.img5         1091585     1153023       30719+  83  Linux
./fullsd.img6         1153025     1214463       30719+  83  Linux
./fullsd.img7         1214465     2263039      524287+  83  Linux
./fullsd.img8         2263041     2525183      131071+  83  Linux
./fullsd.img9         2525185     3573759      524287+  83  Linux
adamoutler@adamoutler-desktop:~/Desktop/Untitled Folder 3$

upload will take a while. 

Usually it is accessible through uart. I'm waiting on a new bus pirate to tackle this job. I keep blowing them up.

You can update bootloader in Write Program Forcedly => Write BootLoader. Also here is bluetooth update.

 

Also I have found what Write Program Forcedly => Copy device sets something in BSP area (NOR flash) and reboots. So it looks like this copy function is in NOR.

I've developed a safer solution for this. https://play.google.com/store/apps/details?id=com.adamoutler.extremebricksimulatorprofessional

 

Be very careful.

Noone has tried Drive maintenance => Dump by Sector => Storage SD ? I'm not speaking about Copy Device menu function. I can try to disassemble this Dump by Sector mode functions and screens.

Yeah. Which sector would you like? I can get any sector on the disk... All 16G of sectors are available... One at a time.

I think you're right. That looks like it is drawing the entire screen once per cycle. Unless there is a way to bypass the screen drawing, updates would not be possible.

 

Still pulling the SDCard. I've got 3 parts out of 7. That .2 is coming out 0-length every time still.

Where is the code behind this menu?

So not sure if this will work, but i wonder if we may be able to access adb over bluetooth http://stackoverflow.com/questions/11129817/adb-over-bluetooth-android

 

and the logs I dumped from @AdamOutlers original info script mentions:

<6>[    1.017995] Bluetooth: BNEP (Ethernet Emulation) ver 1.3<6>[    1.018003] Bluetooth: BNEP filters: protocol multicast<6>[    1.018012] Bluetooth: HIDP (Human Interface Emulation) ver 1.2

Not sure if that is standard, but adb over bluetooth would make sense from a development perspective.

That would be helpful, but it will come later.

 

For now I'm still working on getting a backup... running into backup 2 producing a 0-length file. Got file 1, but It seems to be running extremely slowly.

#!/system/bin/sh 
#dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.1 count=5859375 bs=512;
dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.2 skip=5859375 count=5859375 bs=512;
dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.3 skip=11718750 count=5859375 bs=512;
dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.4 skip=17578125 count=5859375 bs=512;
dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.5 skip=23437500 count=5859375 bs=512;
dd if=/dev/block/mmcblk0 of=/mnt/udisk/backup.6 skip=29296875 count=5859375 bs=512; 
 #This doesn't work.  the deck times out after an hour or so, or aproximately 4.5 gigs of data transfer.   Maybe it's my USB drive is slow, but I copied 9-gigs once to a different drive. #dd if=/dev/block/mmcblk0 of=/mnt/udisk/fullsd.img bs=512;

Maybe it's not important, but there should be a way to utilize it and if we are creating custom/long-install packages, we should utilize it. I was wanting it to see progress on a multi-part DD operation.

I have gone in and seen the menu, but the wording on it makes me think it is to image from a usb to the internal sd. Which would make sense from a dev perspective.

Any chance you have seen how to increment the menu progress bar?  I would assume there is a linux device somewhere which would allow for the progress/UI in copy_script to be updated. 

Why you are not using testmode ability to copy device? There is at least two menus where you can do this. Copy device and sector-by-sector flash copy.

Copy device allows you to select a device, but doesn't specify to or from. We know it deals with the internal SD, but we don't know how copy device works.

 

I copied 3 sectors manually, then stopped. I'm not doing 16G of sectors into individual files

Yep did/will do the same. However I ended up stopping it as it went past an hour. Any idea how long with these units a dd should take? Stopped mine after about an hour and only got 3.95gb.

Mine turned off on its own after 1.5hr, it got 4.5GB

 

For 8gb, in 3gb chunks, it only took 20-30 minutes. I'm going to try breaking it up into 6-3GB chunks.

 

BTW, it did a 0gb to me once as well, on the same file. But that is the same script I used on the successful run. I purposefully didn't modify it and left those additional commands in place to ensure integrity.

Yea I noticed my attempt following your approach one of the files was completely 0 bytes.

 

Also a heads up, I believe the 8x units have 16gb internal cards.

Ah ha!!! That's it!

I formatted a different thumb drive (sacrificed my Ubuntu installer), and it worked with ntfs. The image is writing now.

I tried and ntfs and ext4, at least on my thumb drive and my 8100 deck, didn't show up in file maintenance and didn't work for copyscript.

 

There are a few partitions missing from my attempt last night so I'm trying again.

Oh dang cool! Is this from your bricked unit or an anonymous source? I will wait then for the script to image my 8000 and my 4100, I also have access to a 4000 but not till the weekend.

This is from my car.

 

You can reverse the IFs and OFs and change seek to skip to flash to your deck. I'm going to combine it all tomorrow.