slackwaredragon

Haven't had time to do a part 3 yet, but I wanted to share how I got ADB to work. I haven't had any time to mess further with my w4500 but since it's running Android OS 4.2.2 then there's a good chance it can be rooted. If we can root it, we'll be able to unlock sdcards via adb among other pretty awesome ideas.

https://imgur.com/a/eybH0uS

Concept is simple, you just need a USB 2.0 Type A to Type A adapter. Or if you're like me and don't have a USB 2.0 version and have to deal with USB 3.0 getting in the way, you can route through a USB 2.0 A/B switch like I did. If the desktop/laptop your using has a dedicated USB 2.0 port, use that. The USB 3.0 port will give invalid device descriptor errors because it keeps trying to negotiate with android auto. Since I only had USB3 to play with at the time, I had to use the A/B switch to get around that issue. It's janky but it works. I'm using Ubuntu 20.04 on this laptop but it works fine in windows too as long as you have adb and fastboot tools installed. 

I know the video is rough, I just figured it'd help someone instead of me waiting to do a better one. 

On 7/14/2021 at 1:39 AM, bstrutton said:

Thanks for the very helpful post. Has anyone done this that has a maestro? My maestro rr refuses to communicate correctly (blinking red light, status nOK on communication screen). Tried flashing maestro w/ latest and re-entering serial number. My serial on screen is same as on chassis even after flash of 4400 modified image.

Thanks.

For me, I couldn't get my Maestro working. I figured the S/N changed when the SDCard reflashed the rom (seems to do that on bootup of the new SDcard if the version is different on the head-unit) but I could be wrong. I tried reflashing my Maestro and it I had problems getting it to flash. Could have been my maestro, my setup or something in-between. I never got around to reaching out to them before I sold the Jeep. I still have the maestro, it just won't flash with the software. 

On 8/12/2021 at 9:10 PM, Twister997 said:

Thanks so much for this walk through.

I just followed the instructions about to weeks ago and got my radio working* again.

Only issue I am having is that my radio works perfectly fine with Apple Carplay but will no longer connect to any Android devices. 

It will connect to Bluetooth for calls, but pandora will not stream via Bluetooth nor will any other audio play from my phone thru the car speakers.

I can't hear anything from the phone until the call actually fully connects and then it works normally until I hang up. This includes not hearing the phone ringing before answering the call. 

As for Android auto, my phone says that it should be available from my car system, but the car doesn't actually display it. 

In fact when trying to connect from the choose your device menu I just get "connection failed" when attempting to connect to my phone. 

 

Any idea what might have gone wrong since everything else seems to work fine? 

Is this just a flash another SD card and try again kind of thing? Have you seen this before in your testing? 

Thanks in advance for any advice. 

Glad to hear you got your radio working again! You might want to try a factory reset on the head-unit and going in your phone and 'forgetting' the w4500nex. My bluetooth and CarPlay worked fine on my Max Pro 11 but I only tested out my old android phone (Google Pixel XL) once or twice. I seem to remember it working but that could have been during the many tests I was doing. I'll dig out that phone and see if I can replicate the issue. If you have another SDCard, you might want to try with jrgutier's sysd.conf. I noticed my w4500 seemed to think it was an w8500 too, however I didn't get the same issues. 

On 8/5/2021 at 9:21 PM, jrgutier said:

I believe that the firmware is defaulting to the W8400NEX when it can't lookup the 4500NEX product XML in sysd.conf. This was resulting in a really delayed startup. I transplanted the correct entry from the 8500NEX 1.08 update file using the strings command on the Platform PRG file, which fixed my problem.

Thank you! I missed this when I ran through the process for the walkthrough above. I found my old AVIC.img that I burned one of the SDcards with and it had the newer sysd.conf. I didn't catch it because the first bootup with the new SDCard is pretty slow (reflashing I think) and I'm using faster SDCards so the wait isn't that bad (but still about 60-75s). Updating with this brings it down to under 30s. 

Reserved for Part 3 (last one, I swear)

[7/13/2021 update - Part 2 added, see second post]

I've gotten a bunch of messages and gave a few empty promises (sorry guys) that I'd write this up. Life got busy and I haven't had time to tinker with my w4500nex, especially since I traded in my Jeep for a well-equipped Ram (that 12" screen is both awesome and underwhelming). I haven't played with this since but I figured at the very least I could give you a how-to so you could get your radios back online and hopefully someone can build upon my work and make these things really powerful. The software might suck, but the audio hardware and features are a lot better than many of the android models you find on eBay. I've broken this up into 3 sections; how to build a working SDcard from an readily available image using Linux, how to dive deeper down the rabbit hole to tinker with the NEX series and finally some thoughts and final notes.

Quick note of warning: Proceed at your own risk, opening up the device will void your warranty which is probably dead anyways. I'm not responsible for modifications you make to your radio. Something will probably go wrong. You might violate laws in your area. Going 88mph may or may not send you back through time - I hold no responsibilities for time paradoxes.

To get started… "My SDCard Died in my w4500nex, how do I fix it?"

What you'll need;

• 8gb or 16gb SdCard that's SDHC. SDHC is important, smaller than 8gb or larger than 16gb cards may not work. Even the right size cards might not work, these things can be finicky. Once you write an image to the card and boot the headunit with it installed, it'll lock the sdcard to the unit and you won't be able to re-use it. Best to have a few different brands as spares to be safe.
• SDCard reader (usb or internal).
  • Bonus: If wanting to experiment with cmd42 (how the SDCards are locked) then know that it seems random on which SDCard readers actually support the CMD42 protocol. 4 of the readers I had did not, but a random chromebook did. Raspberry Pis also support CMD42.
• Linux desktop, laptop or Virtual Machine. I used Ubuntu. This can probably be done on Windows, but I prefer to use Linux when working with Linux-based operating systems.
• Tools and instructions on how to open the NEX radio. (If someone is kind enough to post opening instructions, I'll link them here.)

How to make your own SDCard using the W4400NEX image and get a working touchscreen (read section 3 for more info on why this is necessary)

1. Download the AVH-W4400NEX v1.02 image from this thread (http://avic411.com/index.php?/topic/82490-backups-and-images/page/8/ - first post on that link, the filename should be AVIC.zip).
2. Copy the file to your Linux machine if it's not already there and unzip the archive. You should see a file named AVIC.img. You'll need to mount this IMG file in Linux, access one of the partitions and change the sysd.conf file
3. Before mounting, make sure it's a valid image by using fdisk (fdisk -u -l .\AVIC.img). If you're using the file I linked above, it should have the same output as the below. 

   Disk ./AVIC.img: 7.53 GiB, 8068792320 bytes, 15759360 sectors
   Units: sectors of 1 * 512 = 512 bytes
   Sector size (logical/physical): 512 bytes / 512 bytes
   I/O size (minimum/optimal): 512 bytes / 512 bytes
   Disklabel type: dos
   Disk identifier: 0x95516e09
   
   Device      Boot   Start      End  Sectors  Size Id Type
   ./AVIC.img1      1050624  1071103    20480   10M 83 Linux
   ./AVIC.img2      1071104  1091583    20480   10M 83 Linux
   ./AVIC.img3      1091584  4622335  3530752  1.7G  5 Extended
   ./AVIC.img4      4622336 15042559 10420224    5G 83 Linux
   ./AVIC.img5      1091585  1153023    61439   30M 83 Linux
   ./AVIC.img6      1153025  1214463    61439   30M 83 Linux
   ./AVIC.img7      1214465  3311615  2097151 1024M 83 Linux
   ./AVIC.img8      3311617  3573759   262143  128M 83 Linux
   ./AVIC.img9      3573761  4622335  1048575  512M 83 Linux
   
   Partition table entries are not in disk order.

    

4. Now that you've verified the file, you'll want to mount partition 7 to access the sysd.conf file. To do this you'll want to create a new folder under /mnt (I named my avicpart7) and you'll need to know what the offset of partition 7 is in the SDCard. To get this number, look at the sector size (in this case 512) and do some math (START x SECTORSIZE = OFFSET). For this our offset is 621806080. The command would be sudo mount -o loop,offset=621806080 AVIC.img /mnt/avicpart7 - now when you do "ls /mnt/avicpart7/etc" you should the sysd.conf files in with all the other files in the etc folder.
5. We only care about the main sysd.conf file, you can modify it by doing 'sudo vim /mnt/avicpart7/etc/sysd.conf' (or your text editor of choice) and scroll all the way to "AVH_W4400NEX" and look for "sysdconf.com.TouchType" then change it from "capacitator" to "resistence". Alternatively, you can copy over the one I did at https://pastebin.com/deeQxhzN.
6. Now that you made the changes, go back to your home directory and dismount the partition connected to the image; sudo umount /mnt/avicpart7 (and rm -rf /mnt/avicpart7 if you don't need the directory anymore.)
7. Assuming your using the same PC to write the SD image, stick in a supported SDCard and use dd to write it (i.e. dd if=AVIC.img  of=/dev/sdX bs=4M where sdX = ID of your Sdcard)
8. Pop that bad-boy into your head-unit (remember to insert it into the hidden OS SDCard spot) and watch it boot. Note that depending on what firmware your unit was on, it might reboot a couple of times while it gets reflashed by the v1.02 firmware on the SDCard.
9. Provided you followed my instructions (and that I wrote them out correctly), the head-unit should work now.

This should get you going if you're having problems. The next post below goes more indepth about the environment for those who like to tinker. 

The consulting biz has been insane in the past couple of months so I haven't been able to add more onto my AVH-W4500NEX thread but you basically have a few choices;

• If in warranty (mine only had 1yr), get it replaced through Pioneer. When I called it was a 6-8wk process
• If out of warranty, repair though Pioneer. I got quoted $250 and it was a 6-8wk process. I couldn't get them to sell me the SD card
• Buy the replacement SD card through ebay (don't get the AVH2AVIC with nav, lack of TMS causes reboots - not show stopping but annoying) - $65 and it comes from russia so it takes a few weeks. works decent enough though. You will need to open your radio. 
• Go through my thread (fun with AVH-W4500NEX) and build your own SD card using the details I provided and the W4400 image. If you have good computer skills with embedded systems or even just dealing with config files on android then you can improve my process and even upgrade to the latest version that's running on the W8500NEX. I think you can even kill the TMS check to prevent reboots but I haven't had time to test this theory out. 

I forgot to add, the issues you're seeing is because the internal SD card is dying or filling up with log files. In some cases the SD cards they use can't handle the heat and humidity in certain climates. In other cases it appears that the idatalink will cause a lot of errors to go into the log and fill up the SD card. I suspect this is my issue (I can reproduce) but since I can't unlock the SD card I can't find out for sure. I bought a logic analyzer and sd card sniffer but haven't had the time to pull the radio out of the jeep to do more indepth hacking. 

I'm selling my Jeep soon and buying a truck and travel trailer, I'm gonna swap the stock radio in the jeep and hack around with my W4500nex then but it's still a month or two away. I don't plan on reinstalling it, I'm still pissed at pionner and going with an F350 or RAM 3500 that already has all those features. 

Some quick updates since... well.. my last updates.. 

Quick notes on getting the ACH-W4500nex running with the W4400 image

You don't need to edit any of the .prop files to make the 4400 image work with the W4500NEX, just edit the sysd.conf file in the etc directory on partition 7 (the "Platform or System partition). The hardware is pretty identical between the W4400 and W4500 - the core of the x400 and x500 series is the same actually, only differences are the various modules tacked on. For me the process basically goes like this; Write image to SDCARD > Update SD Card > Install in radio. I installed an SDCard Extension Cable in mine to make the process easier incase the next sdcard fails but I have the room for an external SDcard slot, you might not. 

Couple of warnings;

• You might damage your unit - you probably don't care since it's not working anyways but unless you know what you're doing don't try this on a working unit. 
• Your SDCard is permanently dedicated to this - as soon as you put in the hidden slot and boot the unit the card will be locked with a password nobody knows yet. This means it can't be read by windows/linux/macos/etc and it can't be reformatted or wiped. It's toast to all but the headunit. Buy a few extra just incase and don't use SDcards you can't afford to lose. You probably know this but it's a good reminder. 
• First day or so might be buggy, rebuilding cache and indexing everything seems to really impact performance with older android frameworks. 

Here's the process;

1. Write the 4400 image to an "SDHC" specific SDcard, 16gb is fine. Needs to be SDHC for it to work properly, does not support SDXC cards very well. It's also picky even with the SDHC cards. If your unit won't boot, is extremely slow or reboots multiple times before it boots up then you might need a different SDcard. I have 4 SDHC cards that simply don't boot right, possibly because they don't support the CMD42 locking process the head unit does. 
   • I use dd in linux with ubuntu but you can do this with a few different windows tools too. 
2. Edit the file at /etc/sysd.conf and find the entries for the W8400nex (product model="NX450,UC") then make the following changes under this profile;
   • Change sysdconf.com.hasDetach from FALSE to TRUE (for the detachable face)
   • Change sysdconf.tm.tmc from FALSE to TRUE (TMC doesn't exist in this model, leaving this enabled slowed down my unit) 
   • Change sysdconf.com.TouchType from "capacitor" to "resistence" (important for the touch screen to work) 
3. Install the SDcard back into the headunit (for those new to the program, it's internal so the you need to take it part to access) and boot it up. One of a few things will happen;
   • you'll get to the home screen and it works - awesome! 
   • it'll act up but eventually make it to the homescreen and/or be really slow
     • Most likely it's going to be the SD, especially if it boots with distorted graphics or reboots multiple times. Try another SDHC (8gb to 16gb) from a different manufacturer. Quicker SDs (i.e. 100mb/s Class 10) seem to make it more responsive but Class 4 work just as well. SDXC cards usually 64gb or higher generally causes a huge 1+m lag in boot and very spotty interface. 
     • Check to make sure you saved the file in the right place, or that you didn't accidently delete a quotation mark.
   • it won't work and just keeps boot looping eventually to an error. 
     • SD card is not supported or the image isn't being read. Try putting the Sdcard back into a machine, if it reads fine then something is wrong with the headunit. When it's working, it'll running a command called CMD42 that locks the SDCard with a password. It will do this even for blank SD cards (ask me how I know). If your SDcard isn't write protected your unit is probably either bricked or hardware has failed. 

Once it boots everything should work except for maybe idatalink maestro so my steering wheel controls are down. When I pull my dash again and reflash I'll report back. For me HD Radio, SiriusXM, Carplay, Android Auto, Bluetooth, Wifi and backup camera all worked. I haven't tried all the other features yet but I suspect they work too. iGo navigation icon shows up but won't load. Also now my radio self-identifies as a W8400nex instead of a W4400nex so there's that. That's why we I to edit those entries in sysd.conf instead of the W4400 entries. I suspect there's a config file somewhere on the image that I haven't found that sets the model. 

There's a lot more to be done, I'd like to map out what some of the options are in sysd.conf and how to unlock the cards. Debug and all that would be nice but I'm focusing on trying to root Android Automotive. It's a really old version of android (4.2.2) so it shouldn't be all that difficult. 

At some point I'll update the first post in this thread with a much better set of instructions. This can help get people going as more waves of W4500s start to fail. 

1 minute ago, Hackowell said:

Im glad to see people finally getting somewhere on the 4500. I have mine apart with the SD out and Im trying to decide if I want to bother with it. We sell Kenwoods also at my shop and they seem so much faster than Pioneers flagships. The excelons really just work well. The only Pioneer as fast IMHO is the 4660 but just to get it installed and updated in a customers car is an extra 30 min over Excelons. I love the capacitive face response, so smooth. We have tried updating the 4660 over phone app and with USB and almost always have to use USB. Tried Apple and Android for the new CarAVAssist app, and it is still buggy and too involved for a customer, as they might brick it. After the amount of 4500s we are now dealing with due to bricked SD cards I am glad they switched to flash memory like Kenwood, but it sure takes away from the fun of playing with the files. Im sure someone will crack that at some point soon. 

I actually went from a DMX7706 to this because the DMX was too buggy with carplay and didn't play with my Jeep well (steering controls would drop like mad). Ended up returning it and picking up the pioneer. The higher-end one were much better quality though, I snagged this pioneer because I didn't want to pay the price of an Alpine which is the typical go-to for the Jeeps. Other than the SDCard failing they're pretty solid units, I'd like to think it was just a bonehead decision since I've worked with plenty of mid-range SDcards that don't have these kinds of failure rates under hard conditions. But I've also worked with quite a few Six Sigma process improvement types that'd jump at an opportunity to cut costs and cheap out in the midrange. That or it's a bug that led to a full partition, my other theory. If that's the case they gotta know by now and if they were consumer friendly would publish an update. I just notice that the 8400/8500s are on the same platform with much less complaints, I suspect they use more expensive SDcards in those since they're high end vs mid - that's how they delineate them in the config files; AVH_MID and AVN_HIGH. lol

You can bring them back, but it's not super pretty right now. I'm about to post the instructions. Takes few min of work but it'll boot them with all the original functions working. iGo/NAV icon will show up but doesn't work - not sure the best way to hide that yet. I've burned through 10 sdcards with test images, i've gotta find a better/cheaper supply or figure out how to get the unit to unlock those SDCards for me. If I was better at soldering and had an extra unit, I'd see if I could pull the firmware and sniff out the password. 

@asd255 Thanks for the lib, what changes were made to it? I did a diff and noticed a few byte changes, I added it to my latest flash but haven't tested anything yet. Those posts you made on 4pda have been very helpful, I came across those earlier in the week and have gotten to the menus you referenced. That's why I went ahead and bought your sdcard off ebay, it actually arrived a week early this afternoon. It works perfectly! I tried to make a backup (Florida weather can be brutal on electronics) but it's locked as I kind of expected. Just testing it to make sure it works for QA purposes would lock it. It runs good with all the original functions, igo is a little buggy (crashed a couple of times) but I've noticed new firmwares on old android frameworks (this is android 4.2.2 automotive) tend to take a bit to settle down. I do need to reflash my idatalink rr maestro though, steering wheel controls and status to the EVIC (2018 Jeep Wrangler JKU) aren't working but I can live with that. 

Couple of quick observations with your SDCard;

• Noticed firmware was 1.03 - is that dumped firmware or did you manage to force an upgrade with the W8500nex firmware? I only ask because I suspect that'll work if I can get my w4400 SDcard to run the update. I extracted the 8500 update and it has everything the 4500 needs to run, which I expected since the 4400 and 4500 hardware seem to be the same other than maybe some minor revisions. 
• When I put in the new SDcard you sent me, the headunit rebooted a couple of times. Not like it was doing when I was testing my sdcards, a pretty clean reboot (no screen frizz) like some sort of quick firmware update. I suspect this was a BSP flashing process, have you noticed that too? 

I plan to keep hacking away at the 4500, this has been a fun learning experience. I've managed devs for 20 years and rarely get to dig into embedded systems anymore.

For anyone on the fence on whether or not to purchase the sdcard from ebay - do it if you don't want to tinker other than the install process. It just works. No muss, no fuss. Yes the shipping is slow (comes from Russia) but it beats spending another $700USD on a new stereo. 

Been trying a few things with no luck but failure helps bring success, right? 

Here's where I'm at now; I'm able to unpack the updates thanks to some general android information I found and the help of Bass_Rock's AVIC-NEX scripts. Its been probably a good 8 or 9 years since I dived this deep android but it's starting to come back to me. 

To extract PLATFORM;

1. Unzip the W8500NEX 1.03 update and go into the PLATFORM directory
2. Create a new image using dd without the file header
   1. "dd if=./PJ190PLT.PRG of=./PJ190PLT.aimg bs=512 skip=1"
3. Convert the image from android to standard using simg2img at https://github.com/anestisb/android-simg2img
   1. "simg2img ./PJ190PLT.aimg ./PJ190PLT.img"
4. Mount the image PJ190PLT.img, you can now access it's files. 

To extract USER - note: there are 4 images, _0 for the X000 series, _1 for the X100 series, _4 for the X400 series and _5 for the X500 series. I have a W4500 so I'm going with the _5

1. Create a new image using dd without the file header
   1. "dd if=./PJ190DAT_5.PRG of=./PJ190DAT_5.aimg bs=512 skip=1"
2. Convert the image from android to standard using simg2img 
   1. "simg2img ./PJ190DAT_5.aimg ./PJ190DAT_5.img"
3. Mount the image PJ190DAT_5.img, you can now access it's files. 

Boot partition is a little more involved, I'll update those instructions later. I tried straight copies (mounting the AVIC 4400 image then overwriting the partition data from the update) which booted but bombed the launcher. Could be something I did or could be some sort of checking internally. It wasn't WARP as that data is clear on the SDCard so not sure what the issue is - like I said, probably something I did but it's a good sign it booted. Hell, maybe even the launcher crash will come in useful.

Walking through the various files with binwalk and strings, found the MODECHANGE and COPYDEVICE testmode keys in libNPSysCtrlHandler.so which match the TestMode keys at https://github.com/bassrock/AVIC-NEX so I think they're likley commented out or the process to load them has changed. I'll start deconstructing libNPSysCtrlHandler to see what I can find. Another thought is launching a custom apk or invoking via config. I've found a ton of interesting things in the /app and /lib directories and a few potential things in config files but haven't gotten around to testing them yet. I've locked about 8 SDcards so I need to order some more that should be here this afternoon. I love Amazon Same Day delivery!

Another things like @asd255 said would be to modify the file that holds the dev password. That might might be libchromium_net.so or libandroid_runtime.so, since it holds those strings but I haven't dug into them as deep. Btw @asd255, I've been reading your posts on the russian forum and they've been really informative, also of note google translate has gotten much better. lol

I have a thread over at reddit (attached, comments have the meat) that covers my attempts to bring my w4500nex back to life after the internal SDCard toasted itself. Thus far I've installed an SD Extension cable so I can mess with the SDCard until my replacement arrives from Russia. Since then I've been able to get touchscreen working with the 4400 image posted on the development thread and have been deconstructing the updates to figure out if the sdcard password is somewhere in the updates (it's not on the SDCard but likley in the NOR flash that update does). Since messing around with the system I've locked about 5 of my SDcards (I picked up a bunch just incase). 

So many dead-ends, but here's what I've been able to do so far

• Boot the 4400 image - this lead to the touchscreen not working
• Modified the 4400 image to support the 4500, mostly works. here's what I did;
  • used dd to write the image to sdcard
  • copied build0.prop to build.prop and deleted all the other buildX.prop files - note, not sure if this or the next change is the one that ultimately took effect
  • modified /etc/sysd.conf, updated the 8400nex config (sysdconf.com.TouchType) from "capacitator" to "resistence"
  • Booted the w4500nex with the updated card
• Noticed that when the SDCard changes, the warp cache gets refreshed. This means I can change the files without the system changing them back. Either that or maybe WARP is only relevant after the cache gets built on the sdcard. Not sure. 

Unfortunately while the radio mostly works (if not a bit buggy), I'm unable to login to the developer menu due to the password change from "DEVELOPDBG ON" - I'm digging through to see if I can find where they might have changed the password or bypass the password in general. I'm using binwalk to walk through the various files and updates to see what I can find. My hope is to be able to unlock my original SDcard, it appears to work but is locked which leads me to suspect that it's an issue with a corrupted file or bad block not affecting the whole SDCard. This will allow me to see the changes between it and the 4400 image I downloaded. 

One interesting thing is that it looks like for the most part there's an overall image and each build just has config file changes. If that's the case, I'm really curious with the w8500nex 1.03 image as it might contained updated code while still holding driver support for the w4500. I'm also going to go down the path of looking how to create my own bsp files, I can't seem to figure out how to get this into testmode (the scripts don't seem to work anymore) to turn off the sdcard lock and unlock existing cards. If I can enable OpenSSH or adb over network (found the config files, need to learn more about adb) then I can mess with it while it's running. I hasn't haven't ran scans against it while wifi is running, that's how I gained access into my dashcam. I'm open to any suggestions, but if not with any hope this will help someone else trying to solve their w4500nex woes. 

Please note: I'm not sharing proprietary code/i.e. sdcard images. I'll gladly answer questions and help guide but from the looks of it part of the reason other image files have been taken down are because of DMCA requests. Don't need that kind of noise.