Scribd Logo
Upload

Welcome to Scribd!

  • 361 views

    MH2p Tutorial

    Uploaded by

    spam spam
    The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    MH2p Tutorial

    Uploaded by

    spam spam
    361 views11 pages
    The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

    Original Title

    MH2p tutorial

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    361 views11 pages

    MH2p Tutorial

    Uploaded by

    spam spam
    The document provides incomplete and potentially faulty instructions for modifying a device's firmware through unauthorized means. It describes accessing the device's console through a custom login method, updating the firmware to allow further unauthorized changes, converting the device's region settings, installing additional media databases, patching software components, installing maps data, and other advanced commands. Users are warned to only proceed at their own risk and backup files before modifying anything.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 11

    The following instructions might be

    incomplete and faulty

    Only proceed on your own risk

    Happy bricking!
    1. Shell access via custom challenge/response method
    Update with “SD Update” which will install custom public key for challenge/response login.
    Hold two fingers in top right corner to enter SWUP (RED) Mode.

    Press + Update

    2
    Everything should say N/A except ExceptionList. It is normal, just scroll down and press Start update.

    After update finished, press + Resume

    NOTE: ALL CHANGES ON UNIT SHOULD BE DONE IN RED MENU !!! HOLD 2 FINGERS IN TOP
    RIGHT CORNER, UNIT WILL GO TO RED MENU, ONLY THEN YOU CAN CONTINUE WITH
    FECS/CONVERSION.

    When unit is in red menu, connection to unit can be done via D-Link DUB-E100. You need to change IPv4
    address and mask to same as Harman uses.

    3
    Challenge is on telnet 172.16.250.2.48:22111

    Copy CHALLENGE KEY and ask for a RESPONSE (Use generator, or ask somebody who provides you
    access via tokens)

    4
    Paste response back to putty and press Enter. Putty should close. Now you have opened telnet access
    and can connect with port 23.

    MMX console Telnet: 172.16.250.248:23


    Challenge Telnet: 172.16.250.248:22111

    Note: If you can’t login, you are probably in normal, not in red menu. Go to red menu and try to login
    then.

    5
    If you used EMMC method, password for root will be: harman_f, if you used challenge method, there
    will be no
    password, but only for one time! After reboot unit will ask again for a password. To disable password
    you need to run these commands: (RUN ALL COMMANDS ONLY FROM RED MENU !!)
    mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup
    cp /mnt/swup/etc/nopasswd /mnt/swup/etc/passwd
    sync

    Now, even after reboot, your unit will have no password.

    6
    2. Region conversion
    Login to unit with telnet 172.16.250.248:23 and execute next commands:

    touch /mnt/persist_new/swup/skipCheckMetaChecksumPROD
    touch /mnt/persist_new/swup/skipCheckVariantPROD
    touch /mnt/persist_new/swup/skipCheckInstallerChecksumPROD
    touch /mnt/persist_new/swup/checkAllUpdatesPROD
    touch /mnt/persist_new/swup/allowUserDefinedUpdate

    Reboot unit by long press power button. Extract patched firmware to SD Card.
    Press + User Defined > All > Remove selection from AMP* and DUC2H* > Start software update

    After update finished, you must perform parametrization with VCP. Go to Can Procedures > Apps > Data
    Container

    Check 5F module and load file: A6_mib_4k0035165b.zdc

    In data container check VISIBLE_LANGUAGES_EU or AVAIBLE_LANGUAGES_EU push Load Data. Restart


    unit, EU languages list will be present on MENU now.

    Go to Coding and change to:


    COUNTRY NAVIGATION – EU
    BAND SETTINGS FM TUNER – EU_RdW
    BAND SETTINGS AM TUNER – EU_RdW
    NAVIGATIO SYSTEM: enable

    Go to Adaptation:

    VEHICLE CONFIGURATION: SDS_Region_F: REGION_EU

    NOTE: If you don‘t have sound in tuner after conversion, change PI_ignore to active in coding.

    7
    3. Installing gracenote

    Put Gracenote2 and RadioStationDB folder to root of SD Card, and execute following commands:
    cd / && mount -uw /fs/sdb0

    mount -t qnx6 /dev/mnanda0t177.9 /mnt/gracenotedb && mount -uw /mnt/gracenotedb/

    cp -Vrf /fs/sdb0/Gracenote2/Database/0/EU/* /mnt/gracenotedb/database && cp -Vrf


    /fs/sdb0/Gracenote2/InfoFile/0/EU/Update.txt /mnt/gracenotedb/Update.txt && cp -Vrf
    /fs/sdb0/Gracenote2/Version/0/EU/gracenote.json /mnt/gracenotedb/config/gracenote.json &&
    umount /mnt/gracenotedb

    mount -uw /mnt/misc1 && cp -Vrf /fs/sdb0/RadioStationDB/VW_STL_DB.sqlite


    /mnt/misc1/rsdb/VW_STL_DB.sqlite

    4. Do a backup before modifying or patching any files!


    mount -uw /fs/sdb0/
    cat /dev/fs0 > /fs/sdb0/fs0_mib2p
    cat /eso/bin/apps/fecmanager > /fs/sdb0/fecmanager
    cat /eso/bin/apps/componentprotection > /fs/sdb0/componentprotection

    mkdir /fs/sdb0/fec_backup/
    cp -f /mnt/persist_new/fec/* /fs/sdb0/fec_backup/

    8
    4. Patch SWaP and Component Protection
    Put patched fecmanager according to the version and ExceptionList.txt to root of SD Card. Enter to red
    menu, login with telnet to 172.16.250.248:23 console and execute following commands to replace
    fecmanager:
    mount -uw /fs/sdb0/
    mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
    cp /fs/sdb0/fecmanager /mnt/app/eso/bin/apps/
    chmod 777 /mnt/app/eso/bin/apps/fecmanager
    mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup
    cp /fs/sdb0/fecmanager /mnt/swup/eso/bin/apps/
    chmod 777 /mnt/swup/eso/bin/apps/fecmanager

    And these to change ExceptionList.txt:


    mount -uw /fs/sdb0/
    rm /mnt/persist_new/fec/*
    cp /fs/sdb0/ExceptionList.txt /mnt/persist_new/fec
    chmod 777 /mnt/persist_new/fec/ExceptionList.txt

    Optionally you can also do CP-OFF. Put patched componentprotection file on SD and
    replace with following commands:
    mount -uw /fs/sdb0/
    cp /fs/sdb0/componentprotection /eso/bin/apps/componentprotection
    chmod 777 fecmanager

    9
    5. Maps
    Latest maps can be downloaded from https://app-connect.volkswagen.com/mapupdates/en/car/

    Write navigation data to root of SD Card. Boot into normal mode,


    insert SD, and start update.

    10
    6. Other commands:
    Emergency mode:
    echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-emr-reset >
    /dev/ooc/system

    SWUP mode (RED MENU):


    echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-reset >
    /dev/ooc/system

    touch /mnt/persist_new/swup/developmentflag
    mount -uw /mnt/system && touch /mnt/system/etc/startup_test_mode && mount -ur /mnt/system

    Copying engdefs (GREEN MENU) from unit to SD:


    mount -uw /fs/sdb0/
    mkdir /fs/sdb0/engdefs_backup/
    cp -r /mnt/app/eso/hmi/engdefs/* /fs/sdb0/engdefs_backup

    Installing engdefs (GREEN MENU) from SD to unit:


    mount -uw /fs/sdb0/
    mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
    cp -r /fs/sdb0/engdefs /mnt/app/eso/hmi/engdefs/

    11

    You might also like