AdamOutler Posted July 25, 2015 Report Share Posted July 25, 2015 I think have not figured out what TestKey 3 does or how to do the boot sub modes or secondary flags. If we can figure that out I can get adb and change the usb modes. Something else you can try is dd'd the expanded images from the update files of the 8100 to the respective partitions on the 5000 sd card. That should at least get something bootable to force NOR into recovery mode. That is a huge task with no guarantee of working. Each image must have the header removed and we're working with loop devices. I will do that if it comes down to it.. but that will be later because I don't have time now. Can you get Key 1 working? Quote Link to post Share on other sites
bass_rock Posted July 25, 2015 Report Share Posted July 25, 2015 That is a huge task with no guarantee of working. Each image must have the header removed and we're working with loop devices. I will do that if it comes down to it.. but that will be later because I don't have time now. Can you get Key 1 working? I have key 1 working, It just only seems to work though on a booted device following the steps I outlined, I have no clue why. Do you need it sent to you? As for each image removing the header. You just need to comment out 1 line from my script and it will save the .img out for you. Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 25, 2015 Report Share Posted July 25, 2015 [deleted post] Quote Link to post Share on other sites
AdamOutler Posted July 25, 2015 Report Share Posted July 25, 2015 no I have it. I think I've done all I have time to do today. I'm making an AVIC-5000NEX SDCard and I will pick up on dd'ing the partitions tomorrow. Quote Link to post Share on other sites
AdamOutler Posted July 25, 2015 Report Share Posted July 25, 2015 You need working device to use testmode keys. As I said before, testmode keys checked in /lib/libNPSysCtrlHandler.so, so system need at least load this "dll" file during startup. But I propose to look at the source code of the U-Boot sources, there is a lot of useful info. As I said before, it is possible to change boot flags in bsp (NOR flash) in U-Boot. Look at uboot_imx\uboot_imx\src\common\cmd_bootconfigs.c Yeah, but Keys N2 and N3 operate properly. N1 does not. That's the one I need. Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 25, 2015 Report Share Posted July 25, 2015 [deleted post] Quote Link to post Share on other sites
bass_rock Posted July 25, 2015 Report Share Posted July 25, 2015 So been looking around. The test mode looks like it may be the same as http://avic411.com/index.php?/topic/35253-advanced-puzzles-testmodekey-scriptexecini/ I have tried the script on the n_2 and the n_3 and get the following Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_3/TESTMODE_N.KEY 002008000120ENHE Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_2/TESTMODE_N.KEY 002008000120EIEY It now comes down to really figuring out the test mode files as they open us up to easier modifications and the ability to recover without removing the SD Card. @AdamOutler everytime I modify the Boot image it will not boot anymore, so I am wondering if there is a checksum we are missing somewhere. Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 25, 2015 Report Share Posted July 25, 2015 [deleted post] Quote Link to post Share on other sites
bass_rock Posted July 26, 2015 Report Share Posted July 26, 2015 @whatisbypass. Can you dump the strings for that as I assume it's a bit different on our models. Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 26, 2015 Report Share Posted July 26, 2015 [deleted post] Quote Link to post Share on other sites
bass_rock Posted July 26, 2015 Report Share Posted July 26, 2015 It really comes down to figuring out the method to the data in the testmode_n files as those do specific functions and n_2 and n_3 are the same up until the change from flag 8 to flag 12. So if we can figure out the bit setting or encryption (if they use encryption on those files) We allow ourselves to flip the bits in the bsp without needing a jtag. Quote Link to post Share on other sites
bass_rock Posted July 26, 2015 Report Share Posted July 26, 2015 Also thinking about it, my 8000 did not work well with the 5000 sd card image (The screen would not tilt or think it could tilt) as it seemed to have something on the EXTDATA partition (the one partition that the updates don't touch). I wonder if the Bluetooth audio for Android Auto and the system is looking for some key or piece of information on this EXTDATA partition, that the x000's do not have. But, again it comes down to figuring out the TestMode Keys, enabling debuging and ADB with them, then browsing the filesystem, seeing the logs and comparing the EXTDATA partitions. Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 26, 2015 Report Share Posted July 26, 2015 [deleted post] Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 26, 2015 Report Share Posted July 26, 2015 [deleted post] Quote Link to post Share on other sites
WhatIsWhatIsWhatIsWhat Posted July 26, 2015 Report Share Posted July 26, 2015 [deleted post] Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.