AdamOutler

3-part AVIC-8100 image inbound to https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F8100%2F Max filesize is 4GB per file on FAT32, so I split it into 3GB chunks and I didn't know the entire size, so we have a 9-gig image uploading now. The files should concatenate together, but they may contain an extra 512bytes at the beginning of .2 and .3. I'm also uploading the script used to pull it.

place semicolons at the end of each line and remove the shebang(#!) line at the beginning. Rely upon the executor itself. This will make it run as a one-liner.

I believe github has wikis available. I know googlecode does, but they are shutting down soon. As for execution... "put Copy_Script.sh into root dir of USB1 and test XXTECHNICALXX mode using ProgramFunction => CopyShellUpdate" Is what was said on the previous page. I'd like a copy of said key.

bass_rock, I've added in a listing here so we know what partitions to pull to make a FULL sdcard backup I added in "ls -alR /dev/block >>$out" and "ls -alr /dev/block >>$out" because sometimes ls requires lower case and sometimes upper case. but, once we know the partition layout we can get an actual living SDCard from your device using "dd if=/path/to/sdcard0 of=usb2/pioneer-avic5000-sdcard.img" If this works, we just need someone with an x1xx unit to help me get my deck unbricked.

I'm actually a nobody on XDA now. I used to be very involved with the forums, an XDATV Host, a newswriter, an Elite Recognized Developer, and I ran my own contracting firm at casual-dev. I had to retire because I took a job with TracFone as an embedded systems security engineer, and they paid me well enough to give it all up. I could ask just as well as you could, but moving to XDA-Developers would sorta exclude me due to contractual obligations.

Awesome. Bass, please take note of this and change that out variable accordingly. Yes. /system/bin/sh is usually where Android's sh is kept. There is no /bin and /sbin is just some crash handling bs. In a rare case I saw /system/xbin/sh, and while I'm not at my computer now, I'd say /system/bin/sh is where its located. Do you have reason to doubt that?

bass_rock, here is the script. #! /system/bin/sh out="/sdcard/log.txt" echo "--id--">$out id 2>&1 >>$out echo "--mount--">>$out mount 2>&1 >>$out echo "--proc/mounts--">>$out cat /proc/mounts >>$out echo "--netstat--">>$out netstat -Af>>$out netstat -r>>$out echo "--dmesg--">>$out dmesg 2>&1 >>$out echo "--logcat--" >>$out logcat 2>&1 >>$out echo "--ifconfig--" >>$out ifconfig 2>&1 >>$out paste the contents from /sdcard/log.txt if /sdcard/ isn't proper, I have note

The boot.img is a raw-partition, header'd image on the internal SDCard. It consists of a ramdisk, kernel and parameters. The ramdisk is the root filesystem of the device and is loaded directly from this file. Any changes to this filesystem will not persist. The way Android works, in contrast to other Linux systems, is the initrd remains mounted instead of being replaced by a physical disk after drivers are loaded. The system can be modified, but the kernel/ramdisk cannot. The solutions are: 1. Figure out how to re-header the boot.img after modification to the ramdisk inside. 2. Utili

Does it sign on its own? Every time we have tried to modify them, we get an error on the boot.img. There is more work left.

BTW.. I noticed yesterday, each partition appears to be signed. An Android boot.img starts with "ANDROID!". These images on the SD start with a header. Now we need to figure out how to sign an SD Image. The SD has a series of 00's instead of FF's. This is as far as I got yesterday in that area. I began looking for methods of executing files which you have found. Now the single, final task is to figure out the partition headers on the SD.

Awesome! Let's get a script with the outputs of dmesg, logcat, and id ported to a file on the SDCard. Next we will want to install apps and execute them. We need a live terminal active on the device. Good work guys! You've just busted through gaining access all the way through to maintaining access. Stages of ethical hacking 1.Reconnaissance 2.Scanning & Enumeration 3.Gaining Access [Escalation of privileges] 4.Maintaining Access 5.Covering Tracks Now we bounce around between 1-4 for a while until we are able to create a full update. But the important thing is that

Generally, in order to use USB-OTG, the pin #4 or X must be grounded for the USB hardware controller to understand that it is supposed to receive and supply power. A standard USB port has just 4 pins while a device has 5 to designate charging/otg. You may need to locate hardware test points.

Yeah, but Keys N2 and N3 operate properly. N1 does not. That's the one I need.

no I have it. I think I've done all I have time to do today. I'm making an AVIC-5000NEX SDCard and I will pick up on dd'ing the partitions tomorrow.

That is a huge task with no guarantee of working. Each image must have the header removed and we're working with loop devices. I will do that if it comes down to it.. but that will be later because I don't have time now. Can you get Key 1 working?

ok. So, i'm using an 8100NEX and that 5000 NEX does not boot. The closest thing I can do is 1. Boot without an Internal SDCard 2. Insert Internal SDCard 3. Insert USB Test Key. 4. Observe the device entering the new mode Test Key N1 does not affect operations Test Key S does not affect operations Test Key A does not affect operations I think I need Test Key 1 to work. How do the secondary settings operate on the device, such as Magic Numbers and Boot Modes? I need to enter EasyRecovery or Recovery somehow to flash this back to stock. Here is test key N3. What

2. how do you boot with the image if you remove the sdcard? 3. At this state is it powered on normally? 4. does it perform booting automatically? I'm asking you to clarify everything. What state is the device in, per step, and what actions did you perform? I was only able to get this screen below once, and I have no idea what I did to force it to enter this mode. I also don't know which device was target and which was host, nor did I mark which key was used.

OK. So what we need now is to modify the kernel or the system to cause a script to execute "$(sleep 60;am start -n com.whatever.testmode/testmode) &". Which will go into a background task, wait 60 seconds and then launch an APK. I can tell you what to type if you post the apk in question. Bass, were you able to modify the kernel or system yet? We need an entry point for execution. The same technique will work on an Android Terminal Emulator. I'm going to get started on bringing my system back to life again, then begin work on bringing up a terminal, then root, then wor

Sounds like DRM. The deck is likely initialized with some special keys from the factory. Try flashing the original SD Image once again, then perform all available updates even if they are redundant. It's possible one could contain a default DRM. Also, ensure you flash a totally stock image and not modified.

Please share the sha256 of your rar and image for quality purposes.

try unrar e /path-to/file.rar here's the layout. adamoutler@adamoutler-desktop:~/Desktop/avic$ fdisk -l ./avic_5000nex_sd.img Disk ./avic_5000nex_sd.img: 8068 MB, 8068792320 bytes 128 heads, 16 sectors/track, 7695 cylinders, total 15759360 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System ./avic_5000nex_sd.img1 1050624 1071103 10240 83 Linux ./avic_5000nex_

That's how I got where I'm at. I flashed and then flashed back. I can't boot 5000. It errors out.

We don't have an 8100 image. I'm well aware of how to make an SDCard.

Will attempt this weekend.

I will try it. But, I can't really get anywhere on my device. How do I do it? This is all i see when booting that image.