Porsche PCM Upgrade/Hack for Android Auto? Is this real?
09-20-2021, 03:12 PM
#406
Basic Sponsor
Rennlist
Site Sponsor
Rennlist
Site Sponsor
Nowadays,patching is history.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
The following users liked this post:
yalmac (09-21-2021)
09-20-2021, 03:37 PM
#407
RL Community Team
Rennlist Member
Rennlist Member
Nowadays,patching is history.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
09-21-2021, 01:56 AM
#408
Can you send me PM? If you can give your contact details will be good 
Nowadays,patching is history.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
There is a new approach that I am using for about 1 year already.
Codes are tied to unit & VIN,just like OEM install,they don't get deleted during firmware update,and reactivation is only needed if PCM fails and gets replaced.
It also works on PCM5 also,but need to figure out how to deploy them on PCM5 except using PIWIS,because it would be too expensive for people to buy PIWIS for Carplay or Android Auto activation.
I am currently building special OBD2 adapter that will let me remote access and to install the code.
09-21-2021, 06:07 AM
#409
Nordschleife Master
I'd be interested in the OBD2. Please post details when you get it done!
09-29-2021, 12:18 AM
#410
long time reader but finally subbed because of this thread - taking delivery of a 2018 991.2 GT3 soon and am anxiously reading / ordering parts.
simaservis1108 - might need your help if i can't wrap my head around all the technical details
simaservis1108 - might need your help if i can't wrap my head around all the technical details
09-29-2021, 12:20 PM
#411
long time reader but finally subbed because of this thread - taking delivery of a 2018 991.2 GT3 soon and am anxiously reading / ordering parts.
simaservis1108 - might need your help if i can't wrap my head around all the technical details
simaservis1108 - might need your help if i can't wrap my head around all the technical details
Less than 20 minutes.
Took more time to drive to the electronics store to get a USD-SD card adapter as my computer didn't have an SD slot.
09-29-2021, 12:29 PM
#412
Intermediate
long time reader but finally subbed because of this thread - taking delivery of a 2018 991.2 GT3 soon and am anxiously reading / ordering parts.
simaservis1108 - might need your help if i can't wrap my head around all the technical details
simaservis1108 - might need your help if i can't wrap my head around all the technical details
Last edited by Seth K; 09-29-2021 at 12:30 PM.
09-30-2021, 06:28 AM
#415
I saw this thread and was also impressed with Chris's original work to hack the PCM. While I appreciate the efficiency of paying someone to hack your system, some people like to do it themselves. I wrote the following to start documenting how to access the PCM settings, and ultimately allow someone to add add Android Auto or other features. I'm not done writing this up, and I could use some screenshots.
This guide is designed to give you background knowledge and process on PCM hacking. It can be a primer for you to perform your own research necessary to modify your vehicle. Because of the differences in vehicles and layers of knowledge required to troubleshoot vehicle hacking, this guide is not a comprehensive walkthrough for ‘your’ car.
Terminology we will use
PCM - Porsche Communication Management. This is the hardware and software making up the stereo, display panel, various antenna and radios, and available software features in a car. The standard PCM features are documented in the vehicle manual that comes with the car. Support and warranty is provided by your dealer and by Porsche.
MMX - the Multi Media Controller. A sub-component of the PCM system. Configurable over telnet on port 23
GEM - Green Engineering Menu. This is a ‘developer’ interface to the PCM which is initially locked out on Porsche vehicles. We will use GEM to gather information about the PCM beyond what is available in the standard interface. GEM is unsupported by Porsche. It is accessed by pressing specific buttons on your radio once the feature is unlocked by MIB.
MIB - More Incredible Bash. (Bash is ‘Bourne Again Shell’, a software interface native to many Unix/Linux operating systems). MIB provides an interface with predefined actions you can take on a PCM to modify its existing software features. This software is supported by a community of MHI2 hackers, and appears to be extensively documented in various forums.
MHI2 - This is the model PCM installed in the MY20 / 21 718’s. This model is made by Harman Automotive group. Harman is used by the Volkswagen Automotive Group in many vehicle lines including Bentley, Audi, Skoda, Volkswagen, Porsche. In laymens terms this is the 'radio' system in the car.
MY## - Model Year (## the year). MY21 is a 2021 year model car, MY20 is a 2020 year car etc.
FEC - Feature Enablement Code. These are numbers representing software features enabled in the PCM. Using GEM and MIB, you can query and export your car’s existing FEC’s and identify which features your car has (features represented on your build sheet, and features not represented on your build sheet but that are still configurable in the car). When modifying FEC’s in the PCM, a software license signing process must take place to activate the FEC feature. This signing process is done using tools possessed by authorized service centers. This process is circumvented by hackers by patching software running in the PCM.
File systems on the PCM - I'll come back to this and why patching your PCM isn't that difficult or dangerous.
Your Goals
You likely wish to add Android Auto, Navigation, Carplay, the Track Precision app or change a region or map pack on your car. Accessing these features are discussed in this walkthrough.
Overview of this guide
bradlee@watchtower:~$ ifconfig -s
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 0 0 0 0 0 0 0 0 BMU
enx000ec6728c57 0 0 0 0 0 0 0 0 0 0 BMPOU
lo 65536 0 184803277 0 0 0 184803277 0 0 0 LRU
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0088 value 0x01
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0089 value 0x20
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008A value 0x05
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008B value 0x3c
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0048 value 0x01
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0049 value 0x20
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004A value 0x05
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004B value 0x3c
Unplug the usb->ethernet adapter. Plug it back in.
Check the output of lsusb to confirm our ethernet adapter represents the new pid/vid
Plug the ethernet adapter into your car (glove box USB port)
Connect your laptop ethernet port with an ethernet cable to the usb->ethernet adapter plugged into the car (you should see lights on your adapter light up now)
Configure your laptop ethernet port with a static IP address, 172.16.250.250, subnet mask 255.255.255.0
Turn the car on but don’t start the engine.
telnet to the PCM RCC on port 123
Put SD card in slot 1 - (driver side for US models)
# Mount SD card in slot SD1
mount -uw /net/mmx/fs/sda0/
# start M.I.B by typing
/net/mmx/fs/sda0/start
You will see a window now with a title ‘MIB’ and more colorful text.
If you got this far, now is a good time to turn off your car, and re-turn the key so that power does not turn off during next steps. You will telnet back to your PCM again and re-launch MIB to resume.
Backing up PCM
Look for the menu, ‘Developer Menu activation’. Run that. Your PCM will restart after dev mode is enabled. You may need to reconnect to your PCM over telnet.
After PCM has restarted, press ‘Car + Tuner’ buttons on the PCM for 3-5 seconds. You should see a menu which says ‘starting up’ in green text.
Install MIB in GEM
TODO
This guide is designed to give you background knowledge and process on PCM hacking. It can be a primer for you to perform your own research necessary to modify your vehicle. Because of the differences in vehicles and layers of knowledge required to troubleshoot vehicle hacking, this guide is not a comprehensive walkthrough for ‘your’ car.
Terminology we will use
PCM - Porsche Communication Management. This is the hardware and software making up the stereo, display panel, various antenna and radios, and available software features in a car. The standard PCM features are documented in the vehicle manual that comes with the car. Support and warranty is provided by your dealer and by Porsche.
MMX - the Multi Media Controller. A sub-component of the PCM system. Configurable over telnet on port 23
GEM - Green Engineering Menu. This is a ‘developer’ interface to the PCM which is initially locked out on Porsche vehicles. We will use GEM to gather information about the PCM beyond what is available in the standard interface. GEM is unsupported by Porsche. It is accessed by pressing specific buttons on your radio once the feature is unlocked by MIB.
MIB - More Incredible Bash. (Bash is ‘Bourne Again Shell’, a software interface native to many Unix/Linux operating systems). MIB provides an interface with predefined actions you can take on a PCM to modify its existing software features. This software is supported by a community of MHI2 hackers, and appears to be extensively documented in various forums.
MHI2 - This is the model PCM installed in the MY20 / 21 718’s. This model is made by Harman Automotive group. Harman is used by the Volkswagen Automotive Group in many vehicle lines including Bentley, Audi, Skoda, Volkswagen, Porsche. In laymens terms this is the 'radio' system in the car.
MY## - Model Year (## the year). MY21 is a 2021 year model car, MY20 is a 2020 year car etc.
FEC - Feature Enablement Code. These are numbers representing software features enabled in the PCM. Using GEM and MIB, you can query and export your car’s existing FEC’s and identify which features your car has (features represented on your build sheet, and features not represented on your build sheet but that are still configurable in the car). When modifying FEC’s in the PCM, a software license signing process must take place to activate the FEC feature. This signing process is done using tools possessed by authorized service centers. This process is circumvented by hackers by patching software running in the PCM.
File systems on the PCM - I'll come back to this and why patching your PCM isn't that difficult or dangerous.
Your Goals
You likely wish to add Android Auto, Navigation, Carplay, the Track Precision app or change a region or map pack on your car. Accessing these features are discussed in this walkthrough.
Overview of this guide
- Prerequisites
- Connecting to the car
- Launching MIB
- Enabling GEM
- Patching the PCM
- Enabling features
Prerequisites
You need a usb to ethernet adapter with chipset ASIX AX88772.
Get a FAT32 formatted SD card, 16GB > if you are planning to upload maps, otherwise 1 and 2GB cards work.
Download MIB (215MB or so) from https://mibsolution.one/#/1/18 (login guest / guest). Unzip the contents of the MIB file into the SD card.
You need linux utilities ‘lsusb’, ‘ethtool’ and ‘ifconfig’ installed on a linux/unix computer that you can physically plug the usb->ethernet adapter into. There are many ways to install these utilities if you don’t have them already, use google.
Configure the ethernet adapter settings to imitate one Porsche allows.
Get a FAT32 formatted SD card, 16GB > if you are planning to upload maps, otherwise 1 and 2GB cards work.
Download MIB (215MB or so) from https://mibsolution.one/#/1/18 (login guest / guest). Unzip the contents of the MIB file into the SD card.
You need linux utilities ‘lsusb’, ‘ethtool’ and ‘ifconfig’ installed on a linux/unix computer that you can physically plug the usb->ethernet adapter into. There are many ways to install these utilities if you don’t have them already, use google.
Plug your usb->ethernet adapter into your linux/unix computer
Identify the USB->ethernet adapter plugged into your linux/unix system
From a terminal on your linux systemIdentify the USB->ethernet adapter plugged into your linux/unix system
bradlee@watchtower:~$ ifconfig -s
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 0 0 0 0 0 0 0 0 BMU
enx000ec6728c57 0 0 0 0 0 0 0 0 0 0 BMPOU
lo 65536 0 184803277 0 0 0 184803277 0 0 0 LRU
enx000ec6728c57 is our adapter. If you’re not sure which adapter is the right one, disconnect it, run ifconfig again and see which device ‘Iface’ is missing from the list.
Confirm the default pid/vid of the DUB-E100 usb->ethernet adapter. This is how the adapter appears to my linux machine before modifying it.bradlee@watchtower:~$ lsusb | grep ASIX
Bus 001 Device 007: ID 0b95:7720 ASIX Electronics Corp. AX88772
0b95:7720 is the current pid/vid.
Flash the USB Adapter pid/vidBus 001 Device 007: ID 0b95:7720 ASIX Electronics Corp. AX88772
0b95:7720 is the current pid/vid.
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0088 value 0x01
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0089 value 0x20
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008A value 0x05
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008B value 0x3c
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0048 value 0x01
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0049 value 0x20
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004A value 0x05
bradlee@watchtower:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004B value 0x3c
Check the output of lsusb to confirm our ethernet adapter represents the new pid/vid
bradlee@watchtower:~$ lsusb | grep ASIX
Bus 001 Device 008: ID 2001:3c05 D-Link Corp. DUB-E100 Fast Ethernet Adapter(rev.B1) [ASIX AX88772]
If you see 2001:3c05 you are successful. Now you have configured your adapter to be compatible with your Porsche PCM.
Bus 001 Device 008: ID 2001:3c05 D-Link Corp. DUB-E100 Fast Ethernet Adapter(rev.B1) [ASIX AX88772]
If you see 2001:3c05 you are successful. Now you have configured your adapter to be compatible with your Porsche PCM.
Connecting to the car
Connect your laptop ethernet port with an ethernet cable to the usb->ethernet adapter plugged into the car (you should see lights on your adapter light up now)
Configure your laptop ethernet port with a static IP address, 172.16.250.250, subnet mask 255.255.255.0
Turn the car on but don’t start the engine.
telnet to the PCM RCC on port 123
bradlee@watchtower:~$telnet 172.16.250.248 123
This will prompt you for a login name and password
Login name: root
Password: look this up ahead of time, at https://mibsolution.one/
Login name: root
Password: look this up ahead of time, at https://mibsolution.one/
You will need to lookup your model PCM’s login credentials. A list of possible credentials is in the MIB zip file, 'date_MHI2_Password_List_V##.pdf'
On a US model MY21 718 PCM, root / CeaCCDmi were the credentials to login. Other model PCM credentials are in a pdf in the MIB download you put on the SD card.
Launching MIB
Put SD card in slot 1 - (driver side for US models)
# Mount SD card in slot SD1
mount -uw /net/mmx/fs/sda0/
# start M.I.B by typing
/net/mmx/fs/sda0/start
You will see a window now with a title ‘MIB’ and more colorful text.
If you got this far, now is a good time to turn off your car, and re-turn the key so that power does not turn off during next steps. You will telnet back to your PCM again and re-launch MIB to resume.
Backing up PCM
FIRST THING before you start changing settings in MIB. Run ‘Advanced Backup’.
You want a full backup of your PCM so if anything happens you have a place to restore from.
Full backup takes 5-10 minutes to write all data to SD card.
You want a full backup of your PCM so if anything happens you have a place to restore from.
Full backup takes 5-10 minutes to write all data to SD card.
Enabling GEM
Look for the menu, ‘Developer Menu activation’. Run that. Your PCM will restart after dev mode is enabled. You may need to reconnect to your PCM over telnet.
After PCM has restarted, press ‘Car + Tuner’ buttons on the PCM for 3-5 seconds. You should see a menu which says ‘starting up’ in green text.
Install MIB in GEM
An option to install MIB into GEM exists in the MIB menu. Run that. This allows you to launch MIB without the need for your laptop. The SD card with MIB copied to it must be in the PCM to run MIB from GEM directly from the PCM.
Launch GEM using PCM buttonsOnce you have enabled GEM and installed MIB, you can disconnect your laptop from the car.
Press and hold ‘Car’ + ‘Tuner’ buttons on the PCM for 5 seconds to launch GEM.
Browse around using the PCM dial *****, you should be able to go forward in a menu or execute an action by pressing the dial button in while selected, to go back a menu roll the dial to the ‘..’ and press the dial button or use the back button on the PCM.
Browse around using the PCM dial *****, you should be able to go forward in a menu or execute an action by pressing the dial button in while selected, to go back a menu roll the dial to the ‘..’ and press the dial button or use the back button on the PCM.
Patching the PCM
TODO
Enabling features
TODO
Last edited by edub; 09-30-2021 at 06:32 AM.
The following 4 users liked this post by edub:
10-14-2021, 01:31 PM
#417
RL Community Team
Rennlist Member
Rennlist Member
Hey guys - can across this. Lets you use Android Auto from your phone if you already have Carplay on the PCM
https://www.amazon.com/gp/product/B0...C3HE4R2D&psc=1
https://www.amazon.com/gp/product/B0...RDVG734K&psc=1
https://www.amazon.com/gp/product/B0...C3HE4R2D&psc=1
https://www.amazon.com/gp/product/B0...RDVG734K&psc=1
10-14-2021, 01:40 PM
#418
Basic Sponsor
Rennlist
Site Sponsor
Rennlist
Site Sponsor
Hey guys - can across this. Lets you use Android Auto from your phone if you already have Carplay on the PCM
https://www.amazon.com/gp/product/B0...C3HE4R2D&psc=1
https://www.amazon.com/gp/product/B0...RDVG734K&psc=1
https://www.amazon.com/gp/product/B0...C3HE4R2D&psc=1
https://www.amazon.com/gp/product/B0...RDVG734K&psc=1
The following 3 users liked this post by simaservis1108:
10-15-2021, 09:22 AM
#419
The following users liked this post:
renken (09-25-2022)
