slackwaredragon Posted January 17, 2021 Report Share Posted January 17, 2021 I have a thread over at reddit (attached, comments have the meat) that covers my attempts to bring my w4500nex back to life after the internal SDCard toasted itself. Thus far I've installed an SD Extension cable so I can mess with the SDCard until my replacement arrives from Russia. Since then I've been able to get touchscreen working with the 4400 image posted on the development thread and have been deconstructing the updates to figure out if the sdcard password is somewhere in the updates (it's not on the SDCard but likley in the NOR flash that update does). Since messing around with the system I've locked about 5 of my SDcards (I picked up a bunch just incase). So many dead-ends, but here's what I've been able to do so far Boot the 4400 image - this lead to the touchscreen not working Modified the 4400 image to support the 4500, mostly works. here's what I did; used dd to write the image to sdcard copied build0.prop to build.prop and deleted all the other buildX.prop files - note, not sure if this or the next change is the one that ultimately took effect modified /etc/sysd.conf, updated the 8400nex config (sysdconf.com.TouchType) from "capacitator" to "resistence" Booted the w4500nex with the updated card Noticed that when the SDCard changes, the warp cache gets refreshed. This means I can change the files without the system changing them back. Either that or maybe WARP is only relevant after the cache gets built on the sdcard. Not sure. Unfortunately while the radio mostly works (if not a bit buggy), I'm unable to login to the developer menu due to the password change from "DEVELOPDBG ON" - I'm digging through to see if I can find where they might have changed the password or bypass the password in general. I'm using binwalk to walk through the various files and updates to see what I can find. My hope is to be able to unlock my original SDcard, it appears to work but is locked which leads me to suspect that it's an issue with a corrupted file or bad block not affecting the whole SDCard. This will allow me to see the changes between it and the 4400 image I downloaded. One interesting thing is that it looks like for the most part there's an overall image and each build just has config file changes. If that's the case, I'm really curious with the w8500nex 1.03 image as it might contained updated code while still holding driver support for the w4500. I'm also going to go down the path of looking how to create my own bsp files, I can't seem to figure out how to get this into testmode (the scripts don't seem to work anymore) to turn off the sdcard lock and unlock existing cards. If I can enable OpenSSH or adb over network (found the config files, need to learn more about adb) then I can mess with it while it's running. I hasn't haven't ran scans against it while wifi is running, that's how I gained access into my dashcam. I'm open to any suggestions, but if not with any hope this will help someone else trying to solve their w4500nex woes. Please note: I'm not sharing proprietary code/i.e. sdcard images. I'll gladly answer questions and help guide but from the looks of it part of the reason other image files have been taken down are because of DMCA requests. Don't need that kind of noise. Quote Link to post Share on other sites
jamesl75 Posted January 19, 2021 Report Share Posted January 19, 2021 SD Password should be: LKPFeD4BcVzESR2Y EDIT: Crap, I just went and read your very detailed update on reddit. This is like the same password you had already tried? Quote Link to post Share on other sites
jamesl75 Posted January 19, 2021 Report Share Posted January 19, 2021 Also, there is another password I saw mentioned somewhere on here for the debug menu, but I cannot find it now. It begins and ends with brackets, like: [DebugBlahblahblah][Off] This is what I was meaning. Probably wouldn't work in this instance: Quote Link to post Share on other sites
asd255 Posted January 20, 2021 Report Share Posted January 20, 2021 nobody knows the password to access the Debug Menu it is encrypted the only way is to patch one of the system libraries. Quote Link to post Share on other sites
slackwaredragon Posted January 21, 2021 Author Report Share Posted January 21, 2021 Been trying a few things with no luck but failure helps bring success, right? Here's where I'm at now; I'm able to unpack the updates thanks to some general android information I found and the help of Bass_Rock's AVIC-NEX scripts. Its been probably a good 8 or 9 years since I dived this deep android but it's starting to come back to me. To extract PLATFORM; Unzip the W8500NEX 1.03 update and go into the PLATFORM directory Create a new image using dd without the file header "dd if=./PJ190PLT.PRG of=./PJ190PLT.aimg bs=512 skip=1" Convert the image from android to standard using simg2img at https://github.com/anestisb/android-simg2img "simg2img ./PJ190PLT.aimg ./PJ190PLT.img" Mount the image PJ190PLT.img, you can now access it's files. To extract USER - note: there are 4 images, _0 for the X000 series, _1 for the X100 series, _4 for the X400 series and _5 for the X500 series. I have a W4500 so I'm going with the _5 Create a new image using dd without the file header "dd if=./PJ190DAT_5.PRG of=./PJ190DAT_5.aimg bs=512 skip=1" Convert the image from android to standard using simg2img "simg2img ./PJ190DAT_5.aimg ./PJ190DAT_5.img" Mount the image PJ190DAT_5.img, you can now access it's files. Boot partition is a little more involved, I'll update those instructions later. I tried straight copies (mounting the AVIC 4400 image then overwriting the partition data from the update) which booted but bombed the launcher. Could be something I did or could be some sort of checking internally. It wasn't WARP as that data is clear on the SDCard so not sure what the issue is - like I said, probably something I did but it's a good sign it booted. Hell, maybe even the launcher crash will come in useful. Walking through the various files with binwalk and strings, found the MODECHANGE and COPYDEVICE testmode keys in libNPSysCtrlHandler.so which match the TestMode keys at https://github.com/bassrock/AVIC-NEX so I think they're likley commented out or the process to load them has changed. I'll start deconstructing libNPSysCtrlHandler to see what I can find. Another thought is launching a custom apk or invoking via config. I've found a ton of interesting things in the /app and /lib directories and a few potential things in config files but haven't gotten around to testing them yet. I've locked about 8 SDcards so I need to order some more that should be here this afternoon. I love Amazon Same Day delivery! Another things like @asd255 said would be to modify the file that holds the dev password. That might might be libchromium_net.so or libandroid_runtime.so, since it holds those strings but I haven't dug into them as deep. Btw @asd255, I've been reading your posts on the russian forum and they've been really informative, also of note google translate has gotten much better. lol Quote Link to post Share on other sites
asd255 Posted January 21, 2021 Report Share Posted January 21, 2021 libNPSysCtrlHandler.so - this is the main library there are many interesting things But checking the password for Debug Menu in the library libdebugmodeproxy_jni.so Quote Link to post Share on other sites
asd255 Posted January 21, 2021 Report Share Posted January 21, 2021 there are several more Debug menus no password is required to access 1 - app test 2 - debug 1 3 - debug 2 app test menu also works on x200 here are screenshots of my article in Russian from 4pda forum Quote Link to post Share on other sites
slackwaredragon Posted January 23, 2021 Author Report Share Posted January 23, 2021 @asd255 Thanks for the lib, what changes were made to it? I did a diff and noticed a few byte changes, I added it to my latest flash but haven't tested anything yet. Those posts you made on 4pda have been very helpful, I came across those earlier in the week and have gotten to the menus you referenced. That's why I went ahead and bought your sdcard off ebay, it actually arrived a week early this afternoon. It works perfectly! I tried to make a backup (Florida weather can be brutal on electronics) but it's locked as I kind of expected. Just testing it to make sure it works for QA purposes would lock it. It runs good with all the original functions, igo is a little buggy (crashed a couple of times) but I've noticed new firmwares on old android frameworks (this is android 4.2.2 automotive) tend to take a bit to settle down. I do need to reflash my idatalink rr maestro though, steering wheel controls and status to the EVIC (2018 Jeep Wrangler JKU) aren't working but I can live with that. Couple of quick observations with your SDCard; Noticed firmware was 1.03 - is that dumped firmware or did you manage to force an upgrade with the W8500nex firmware? I only ask because I suspect that'll work if I can get my w4400 SDcard to run the update. I extracted the 8500 update and it has everything the 4500 needs to run, which I expected since the 4400 and 4500 hardware seem to be the same other than maybe some minor revisions. When I put in the new SDcard you sent me, the headunit rebooted a couple of times. Not like it was doing when I was testing my sdcards, a pretty clean reboot (no screen frizz) like some sort of quick firmware update. I suspect this was a BSP flashing process, have you noticed that too? I plan to keep hacking away at the 4500, this has been a fun learning experience. I've managed devs for 20 years and rarely get to dig into embedded systems anymore. For anyone on the fence on whether or not to purchase the sdcard from ebay - do it if you don't want to tinker other than the install process. It just works. No muss, no fuss. Yes the shipping is slow (comes from Russia) but it beats spending another $700USD on a new stereo. Quote Link to post Share on other sites
Hackowell Posted January 23, 2021 Report Share Posted January 23, 2021 Im glad to see people finally getting somewhere on the 4500. I have mine apart with the SD out and Im trying to decide if I want to bother with it. We sell Kenwoods also at my shop and they seem so much faster than Pioneers flagships. The excelons really just work well. The only Pioneer as fast IMHO is the 4660 but just to get it installed and updated in a customers car is an extra 30 min over Excelons. I love the capacitive face response, so smooth. We have tried updating the 4660 over phone app and with USB and almost always have to use USB. Tried Apple and Android for the new CarAVAssist app, and it is still buggy and too involved for a customer, as they might brick it. After the amount of 4500s we are now dealing with due to bricked SD cards I am glad they switched to flash memory like Kenwood, but it sure takes away from the fun of playing with the files. Im sure someone will crack that at some point soon. Quote Link to post Share on other sites
slackwaredragon Posted January 23, 2021 Author Report Share Posted January 23, 2021 1 minute ago, Hackowell said: Im glad to see people finally getting somewhere on the 4500. I have mine apart with the SD out and Im trying to decide if I want to bother with it. We sell Kenwoods also at my shop and they seem so much faster than Pioneers flagships. The excelons really just work well. The only Pioneer as fast IMHO is the 4660 but just to get it installed and updated in a customers car is an extra 30 min over Excelons. I love the capacitive face response, so smooth. We have tried updating the 4660 over phone app and with USB and almost always have to use USB. Tried Apple and Android for the new CarAVAssist app, and it is still buggy and too involved for a customer, as they might brick it. After the amount of 4500s we are now dealing with due to bricked SD cards I am glad they switched to flash memory like Kenwood, but it sure takes away from the fun of playing with the files. Im sure someone will crack that at some point soon. I actually went from a DMX7706 to this because the DMX was too buggy with carplay and didn't play with my Jeep well (steering controls would drop like mad). Ended up returning it and picking up the pioneer. The higher-end one were much better quality though, I snagged this pioneer because I didn't want to pay the price of an Alpine which is the typical go-to for the Jeeps. Other than the SDCard failing they're pretty solid units, I'd like to think it was just a bonehead decision since I've worked with plenty of mid-range SDcards that don't have these kinds of failure rates under hard conditions. But I've also worked with quite a few Six Sigma process improvement types that'd jump at an opportunity to cut costs and cheap out in the midrange. That or it's a bug that led to a full partition, my other theory. If that's the case they gotta know by now and if they were consumer friendly would publish an update. I just notice that the 8400/8500s are on the same platform with much less complaints, I suspect they use more expensive SDcards in those since they're high end vs mid - that's how they delineate them in the config files; AVH_MID and AVN_HIGH. lol You can bring them back, but it's not super pretty right now. I'm about to post the instructions. Takes few min of work but it'll boot them with all the original functions working. iGo/NAV icon will show up but doesn't work - not sure the best way to hide that yet. I've burned through 10 sdcards with test images, i've gotta find a better/cheaper supply or figure out how to get the unit to unlock those SDCards for me. If I was better at soldering and had an extra unit, I'd see if I could pull the firmware and sniff out the password. Quote Link to post Share on other sites
Hackowell Posted January 23, 2021 Report Share Posted January 23, 2021 Well the soldering thing isnt a problem, I have a smd rework machine and various solder stations. If you can explain the software stuff you need, I can handle the hardware part of it. I have rooted all my android phones and played with roms in the past but Im not a software guy, by any means. I may have another 4500 at work, Im not sure..we sent so many back to United Radio which is the repair center Pioneer tells us to use. I am willing to sacrifice this one, and I have a ton of SD cards if you want me to try something, let me know. Quote Link to post Share on other sites
Hackowell Posted January 23, 2021 Report Share Posted January 23, 2021 Off topic but the DMX706S is what I chose to put in the wifeys new SUV for Xmas. Its hard to beat for the price/features. The Kenwood 47/4707 series has short chassis with capacitive touch but is being built really cheaply by somewhere in China for kenwood. It has the euro power plug and even the packaging is not the standard kenwood stuff. Covid affected our ability to get many models we normally sell so we were grabbing anything we could from Pioneer/Kenwood. We do sell a lot of Alpine for jeeps, I remember when everyone wanted a Halo, but now we do the Stinger Heigh10 often for GM/Jeep and since we almost exclusively use PAC RADIO PRO products, the integration with any headunit works great. What we did find on Kenwoods was the USB cable length mattered so try not to use the extension, or the factory console USB. We put a USBDMA1 where the right side 12v outlet goes and no matter the brand no dropouts. On dual USB models we also tie into the factory USB and it works fine for usb drives, etc. Quote Link to post Share on other sites
slackwaredragon Posted January 23, 2021 Author Report Share Posted January 23, 2021 Some quick updates since... well.. my last updates.. Quick notes on getting the ACH-W4500nex running with the W4400 image You don't need to edit any of the .prop files to make the 4400 image work with the W4500NEX, just edit the sysd.conf file in the etc directory on partition 7 (the "Platform or System partition). The hardware is pretty identical between the W4400 and W4500 - the core of the x400 and x500 series is the same actually, only differences are the various modules tacked on. For me the process basically goes like this; Write image to SDCARD > Update SD Card > Install in radio. I installed an SDCard Extension Cable in mine to make the process easier incase the next sdcard fails but I have the room for an external SDcard slot, you might not. Couple of warnings; You might damage your unit - you probably don't care since it's not working anyways but unless you know what you're doing don't try this on a working unit. Your SDCard is permanently dedicated to this - as soon as you put in the hidden slot and boot the unit the card will be locked with a password nobody knows yet. This means it can't be read by windows/linux/macos/etc and it can't be reformatted or wiped. It's toast to all but the headunit. Buy a few extra just incase and don't use SDcards you can't afford to lose. You probably know this but it's a good reminder. First day or so might be buggy, rebuilding cache and indexing everything seems to really impact performance with older android frameworks. Here's the process; Write the 4400 image to an "SDHC" specific SDcard, 16gb is fine. Needs to be SDHC for it to work properly, does not support SDXC cards very well. It's also picky even with the SDHC cards. If your unit won't boot, is extremely slow or reboots multiple times before it boots up then you might need a different SDcard. I have 4 SDHC cards that simply don't boot right, possibly because they don't support the CMD42 locking process the head unit does. I use dd in linux with ubuntu but you can do this with a few different windows tools too. Edit the file at /etc/sysd.conf and find the entries for the W8400nex (product model="NX450,UC") then make the following changes under this profile; Change sysdconf.com.hasDetach from FALSE to TRUE (for the detachable face) Change sysdconf.tm.tmc from FALSE to TRUE (TMC doesn't exist in this model, leaving this enabled slowed down my unit) Change sysdconf.com.TouchType from "capacitor" to "resistence" (important for the touch screen to work) Install the SDcard back into the headunit (for those new to the program, it's internal so the you need to take it part to access) and boot it up. One of a few things will happen; you'll get to the home screen and it works - awesome! it'll act up but eventually make it to the homescreen and/or be really slow Most likely it's going to be the SD, especially if it boots with distorted graphics or reboots multiple times. Try another SDHC (8gb to 16gb) from a different manufacturer. Quicker SDs (i.e. 100mb/s Class 10) seem to make it more responsive but Class 4 work just as well. SDXC cards usually 64gb or higher generally causes a huge 1+m lag in boot and very spotty interface. Check to make sure you saved the file in the right place, or that you didn't accidently delete a quotation mark. it won't work and just keeps boot looping eventually to an error. SD card is not supported or the image isn't being read. Try putting the Sdcard back into a machine, if it reads fine then something is wrong with the headunit. When it's working, it'll running a command called CMD42 that locks the SDCard with a password. It will do this even for blank SD cards (ask me how I know). If your SDcard isn't write protected your unit is probably either bricked or hardware has failed. Once it boots everything should work except for maybe idatalink maestro so my steering wheel controls are down. When I pull my dash again and reflash I'll report back. For me HD Radio, SiriusXM, Carplay, Android Auto, Bluetooth, Wifi and backup camera all worked. I haven't tried all the other features yet but I suspect they work too. iGo navigation icon shows up but won't load. Also now my radio self-identifies as a W8400nex instead of a W4400nex so there's that. That's why we I to edit those entries in sysd.conf instead of the W4400 entries. I suspect there's a config file somewhere on the image that I haven't found that sets the model. There's a lot more to be done, I'd like to map out what some of the options are in sysd.conf and how to unlock the cards. Debug and all that would be nice but I'm focusing on trying to root Android Automotive. It's a really old version of android (4.2.2) so it shouldn't be all that difficult. At some point I'll update the first post in this thread with a much better set of instructions. This can help get people going as more waves of W4500s start to fail. Quote Link to post Share on other sites
GettinOld Posted February 5, 2021 Report Share Posted February 5, 2021 Thanks for all your hard work with the 4500NEX. I've posted a few posts in the forum about the 4500NEX. So i have a newer 4500NEX I purchased in November. So I have warranty until November 2021. However after hearing all the boot loops, I'm concerned with my unit failing after the warranty period is over. So me being proactive, I'd like to have a SD ready for the day when (not if) my 4500 fails. In the meantime, i'd like to help the cause. Because I have my 4500Nex running with factory SD, is there anyway I can back up my factory SD so we have an actual 4500 image not a 4400? I've tried a testmode using USB1 and searching for the proper way to backup my internal SD but it seems like no one says it for the 4500 unit? Anyways, if you can help that would be appreciate. Thanks again. Quote Link to post Share on other sites
sofmeright Posted July 8, 2021 Report Share Posted July 8, 2021 On 2/5/2021 at 8:33 AM, GettinOld said: Thanks for all your hard work with the 4500NEX. I've posted a few posts in the forum about the 4500NEX. So i have a newer 4500NEX I purchased in November. So I have warranty until November 2021. However after hearing all the boot loops, I'm concerned with my unit failing after the warranty period is over. So me being proactive, I'd like to have a SD ready for the day when (not if) my 4500 fails. In the meantime, i'd like to help the cause. Because I have my 4500Nex running with factory SD, is there anyway I can back up my factory SD so we have an actual 4500 image not a 4400? I've tried a testmode using USB1 and searching for the proper way to backup my internal SD but it seems like no one says it for the 4500 unit? Anyways, if you can help that would be appreciate. Thanks again. This is the guide for making a backup of the internal SD Card my friend I would be very interested in a copy of the backup. My unit is fried hoping you can rescue me so that I won't have to send it to pioneer! http://avic411.com/index.php?/topic/81469-avic-development-mod-device-backup/ Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.