Modifying USA-SBX-12.1-PR-xxxxx 12 inch update

[sickcodes]

Since upstream is focusing on UC5, I'm gonna solve a bunch of UC4 problems.

I'm pretty deep in some update processes and really need a USB update file for an SBX 12.1, any VIN should be fine.

Any old USB updates, just zipped up, would be absolutely perfect.

USA-SBX-12.1-PR-
WORLD-SBX-12.1-PR-

Happy to buy one too since they're out of stock...

Would have bought a USB update, but as I mentioned in https://5thgenrams.com/community/threads/2021-software-and-map-update.37099/post-553777

(Don't try this at home!!)

 

[brewmastr]

Can I ask what you are trying to accomplish?

 

[sickcodes]

I am trying to jailbreak the radio, in good-faith.

As there's no ability to download updates as the USB stick is out of stock, no updates available for VP4R online, I want to Jailbreak my radio and document it.

I'm also pretty close, added QNX6 (the base OS) kernel modules and dumped the entire FS using it: https://github.com/sickcodes/qnx-modules

Trying to access ProgModeSWDL or ideally Btdiag to "diagnose" the vehicle.

 

[sickcodes]

I have 3 VP4R’s for 2020 RAMs, one awesome user has already helped with his USB update images but would really like one more to contrast the two together and see the exact reason why they need to be sent out via post mail rather than an online update. Pretty close to having a solution

 

[sickcodes]

Some of my other Open Source work:

20,000 GitHub stars, 200,000 downloads:

GitHub - sickcodes/Docker-OSX: Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers. - sickcodes/Docker-OSX

github.com

And some videos of cool hacks I’ve pulled off:

 

[Cesar592]

A question you know about this, you know how we can solve the digital rear-view mirror, those of us who have 19 and 20 and why it only works in 2021

 

[sickcodes]

Sometimes on and sometimes off in the above picture.

Another variable named RearViewCameraPresent:

1/pas/scfg/vs_calibration.cfg
8:RearViewCameraPresent=0

10/vs_calibration_2.cfg
35:RearViewCameraPresent=1

10/vs_calibration_1.cfg
35:RearViewCameraPresent=1

2/pas/scfg/vs_calibration.cfg
8:RearViewCameraPresent=0

Again sometimes on and off.

There's also another variable named RVCM which is obviously Rear View Camera Mirror(?) present which is on.

1/pas/scfg/vs_calibration.cfg
300:RVCMPresent=0

10/vs_calibration_2.cfg
356:RVCMPresent=1

10/vs_calibration_1.cfg
356:RVCMPresent=1

2/pas/scfg/vs_calibration.cfg
300:RVCMPresent=0

There's also RearCameraPresent...

1/pas/scfg/vs_calibration.cfg
394:RearCameraPresent=0

2/pas/scfg/vs_calibration.cfg
394:RearCameraPresent=0

10/vs_calibration_1.cfg
450:RearCameraPresent=1

10/vs_calibration_2.cfg
450:RearCameraPresent=1

Also in 2/etc/perm.cfg which means permissions:

(chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/vs_calibration_1.cfg"))
    (chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/vs_calibration_2.cfg"))
    (chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/AnalogRVC"))
    (chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/DigitalRVC"))
    (chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/AnalogSVC"))
    (chmod
        (UID 271)
        (GID 2710)
        (perm 0644)
        (file "/pas/rwdata/DTRvcSvc"))

Would it be reasonable to assume if you have Digital Rear View, you must also have Digital Side View too?

 

[Tbranella]

where are these settings located?
are they in the BCM?

 

[Scap]

This is amazing. Looking forward to see what you figure out.

 

[MannyN]

Just checked with AlfOBD and non of those settings show up. The only one what shows up in DT MY2022 PowerNet is
VehConfig 8-Digital CHMSL Camera Present

 

[sickcodes]

where are these settings located?
are they in the BCM?

This config is scattered over various partitions of the disk on the Panasonic VP4R radio.

And by disk I mean the QNX6 Uconnect NAND flash itself. It’s also on the same board as the SiriusXM module and the Sierra Wireless card.

The memory card is a 32GB SanDisk eMMC, same as any 32GB smart phone. The Uconnect board controls the radio and both are inside the silver box behind the 12 inch display. The harness on the radio is connected to the radio itself which then contacts the BCM and other stuff in the car over over CAN IHS and CAN C, but since the radio is where all connectivity and updates are done (via USB, or OTA maybe one day) it dictates everything about what you get to see on the 12 inch display.

I assume the cameras are all on CAN IHS but on the Uconnect board the most notable thing is that all of the RVC toggles are sometimes on and sometimes off, never one way.

If anyone has any more updates or map updates, especially if you’ve had more than one, would love a copy. I don’t believe they’re tired to VIN.

The BCM will tell the radio if it’s a Ram, Hellcat,

I’ve confirmed this by testing SiriusXM boards and non-SiriusXM boards, and even though it won’t boot (yet) because it hasn’t been “flashed” by the dealer, which means maps, when I swap the non SiriusXM board back in, the RAM logo appears with SiriusXM underneath it. But only once, since it figures out it’s no longer got SiriusXM.

If anyone else could Dropbox me an update I can contrast and compare with the one I have which will show exact differences between USB updates.

@ma1746 UC4 or UC5? As I’m only working on the UC4 at the moment, which is the QNX one. Do you have any update USB sticks?

 

[OCD Solutions]

I just did the UC4 update a few weeks back so I have the latest USB’s. I won’t be home for a couple weeks but I’ll have my wife plug them into my PC and I’ll upload them remotely.

 

[scottmoyer]

Seems you know what you're doing. While you're in programming mode, can you come up with a way to disable the Uconnect "Accept" startup screen? Thanks

 

[OCD Solutions]

Here is a link to download the two USB drives that came with my latest update.

MediaFire

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

This pic is the software update, apparently I never snapped a pic of the map USB.

 

[MannymanX]

FOLLOWING.
Keep up the great work!

 

[sickcodes]

Here is a link to download the two USB drives that came with my latest update.

MediaFire

MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere.

www.mediafire.com

This pic is the software update, apparently I never snapped a pic of the map USB.
View attachment 116110

Thanks for sending!

Confirming USB updates are identical and are not unique, or based on VIN

I’m close to decrypting the update, any hints would be appreciated!

So far I’ve got (from the actual updated code on the radio):

Required & identified pieces:

IV - Initialization Vector, for aes decryption, on the USB.

EFWEK - same as above, it’s called “Hidden Pair” somewhere else.

EncryptedPrivateKey01.bin - encrypted or encoded key for aes-256-ctr symmetrical decryption of the system update, or the maps update, haven’t worked it out yet.

EMSK.bin - 32 byte Master Session Key for x509 decryption, so probably maps since that’s signed using SSL/x509 certificates, whereas the system update is aes-256-ctr or aes-256-ctx.

Issue I’m having is figuring out which key is for which update and also which region etc.

dumpifs for QNX: https://github.com/sickcodes/dumpifs/commit/d408ca51ff075ba6adeee17b858d28780aef8f37

Since internet connection is not required to update the radio, that means all keys are “hardcoded”, as shown by the use of a Master Session Key and IV values that do not change.

Will keep anyone posted! I’m pretty deep in the code, possibly going up the wrong avenue, any ideas on.

At least one of the updates is decrypted using the Private Key (1.7kB, so RSA)
And I assume the Master Session Key (32 bytes, 256bit) is used on the other update...

 

[sickcodes]

If anyone has any more updates, or special tools, I am willing to scratch your back if you scratch mine I can identify exactly “why” functionality is missing now, and I’ve already identified why the SiriusXM update failed which is that the URL they use for telematics address lookup no longer resolves.

Simply put, the server that auto completes addresses such typing is down.

Any other updates out there? If you don’t feel comfortable replying to the thread, you can email me in confidence [email protected] but I am happy to help others publicly as much as I can.

Currently almost finished with what I mentioned above in the last post (sorry for double post)

 

[RHeller1]

I applaud your efforts! Wish I could be of more assistance!

 

[sickcodes]

I applaud your efforts! Wish I could be of more assistance!

Any files or USB updates would be awesome what would be great is the oldest USB or map updates available or any available USB update prior to the one currently available to see if there’s any changes!

 

[MannyN]

Where are we with the digital rear view Mirror? Any news?