Porsche PCM Upgrade/Hack for Android Auto? Is this real?
#91
Intermediate
#92
#93
Instructor
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Enabling Android Auto on PCM4
Step 1. Required Components
Step 2. Connect to PCM4 via UART
Step 3. Download Root-IFS
Step 4. Unpack Root-IFS (if using downloaded image from PCM4)
Step 5. Patch out the FEC checks.
Step 7. Create your new FEC file
Step 8. Load new files to head unit
Step 9. Adaptations
Step 10. Done!
It is important to note that this hack will be overwritten if you ever decide to perform a software update on your PCM4. You'll then have to re-complete these steps with your new version of software. Given that there are no PCM4 updates available, this will probably be a non-issue.
What if I flash a bad ifs image to my head unit?
⁃ If this happens, MIBRoot will fail to start and you will not be able to interface with PCM4. it will appear to boot from the LCD panel, but touch and audio will not work. However, it will still boot into QNX for recovery since we are only flashing the stage2 image.
⁃ To recover, log into QNX with root / oaIQOqkW
⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4.
⁃ Issue commands:
⁃ flashunlock
⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs
⁃ flashlock
⁃ Note: If stage2 ifs flashing fails, flash.it, flashlock and flashunlock may no longer be present on your system. Copy them to your SD card from your extracted ifs directory and run them from the SD card, for example /net/mmx/fs/sda0/flashunlock.
What if my firmware flash works but I still don't have Android Auto?
⁃ Your VIN, VCRN, or FECs may need to be corrected, review step 7. Cars without CarPlay may need to add FECs 00030000, or 00060700 and 00060800
⁃ If your FECs are being removed from FecContainer.fec and being placed into IllegalFecContainer.fec, then your FECs are failing the signature check. Your patch is wrong and you need to review step 5 again.
⁃ If you did not have CarPlay or Android Auto previously, you may also need to code USB media player functionality within PIWIS II.
What if I want to return to stock?
⁃ Connect to PCM4 via UART
⁃ Log into QNX with root / oaIQOqkW
⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4.
⁃ Issue commands:
⁃ flashunlock
⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs
⁃ flashlock
⁃ mount -uw /mnt/efs-persist
⁃ rm /mnt/efs-persist/FEC/FecContainer.fec
⁃ mv /mnt/efs-persist/FEC/FecContainer.fec.orig /mnt/efs-persist/FEC/FecContainer.fec
⁃ Done. Reboot by holding power button for 30s
Step 1. Required Components
- ⁃ UART -> USB Adapter ()
- ⁃ PuTTY or similar terminal app
- ⁃ IDA Pro ($$$$$), Ghidra (free), or similar ARM V7-A compatible disassembler
- ⁃ SD Card
- ⁃ Linux computer to unpack + repack filesystem
- ⁃ dumpifs and mkxfs from QNX SDP / OpenQNX. Build these from source on your linux machine to ensure proper compatibility. (available at https://github.com/ibreakifix/PorschePCMStuff pre-built for Ubuntu 19.04 x64)
- ⁃ mkxfs attributes file from https://github.com/ibreakifix/PorschePCMStuff
Step 2. Connect to PCM4 via UART
- ⁃ Connect GND to GND (PCM4 chassis works), RX on adapter to J5_TX on PCM4, TX to J5_RX on PCM4; pins B3 and B9.
- ⁃ To connect, you can remove the connector block from the quad-lock, then route your TX/RX/GND pigtails through the opening.
- ⁃ Open PuTTY, launch a serial connection to your COM port (see devmgmt.msc) - 115200, 8, N, 1
- ⁃ Login with root / oaIQOqkW
Step 3. Download Root-IFS
- ⁃ Issue the "stfu" command to stop verbose logging to the terminal.
- ⁃ Insert SD card into PCM4, left slot
- ⁃ Issue the following command to download your filesystem: "dd if=/dev/fs0 of=/net/mmx/fs/sda0/PCM4_NOR.bin".
- ⁃ Issue the following command to copy your existing FEC file: "cp /mnt/efs-persist/FecContainer.fec /net/mmx/fs/sda0/orig_FecContainer.fec"
- ⁃ Remove SD card and insert into your PC.
- ⁃ You can also pull this image from an update SD card at ./RCC/ifs-root/*/default/ifs-root.ifs **Note: The desired image is the second ifs contained within this update file, use ctrl+f and find the second instance of file magic "EB 7E FF", your IFS image begins at this location and ends at the end of the file. If you do this, you can skip steps 4.1 to 4.3**
Step 4. Unpack Root-IFS (if using downloaded image from PCM4)
- ⁃ Open downloaded RCC NOR image (PCM4_NOR.bin) in your favorite hex editor
- ⁃ Jump to offset 0xBA0000, ensure IFS magic of "EB 7E FF" is present. If not, issue "flashlock" on PCM4 shell to obtain correct offset, target IFS is ~15.6mb. See screenshot.
- ⁃ Select from 0xBA0000 to the end of the IFS, which is indicated by a block of padding "FF FF FF FF FF". In my case, this data was 15,639,040 bytes. See screenshot.
- ⁃ Cut and paste this block of data into a new file, name it ifsroot_stage2_orig.ifs
- ⁃ Move to a linux computer with dumpifs binary (available from QNX SDP)
- ⁃ Copy ifsroot_stage2_orig.ifs to some folder, open your terminal and CD to that folder.
- ⁃ Copy dumpifs_helper.sh to this same folder. Chmod it to 755
- ⁃ Issue "./dumpifs_helper.sh ifsroot_stage2_orig.ifs" to extract the IFS, your files will be in ./ifs_extracted. Ensure files are present as shown in the terminal output
- ⁃ Place a copy of /usr/apps/MIBRoot so it can be patched with IDA, Ghidra or similar
Step 5. Patch out the FEC checks.
- ⁃ Place your patched MIBRoot into your extracted IFS location, overwriting the old MIBRoot. It should be located at ./ifs_extracted/apps/bin/
- ⁃ Open terminal. Issue command: EXPORT QNX_TARGET="/"
- - cd to whatever the parent directory is to the ifs_extracted folder we made earlier
- ⁃ Download mkifs_attributes.txt from github repo. Place it in your current working directory
- ⁃ Build the new IFS with mkxfs, issue command "mkxfs -t ifs -nn -o ./ -r / ./mkifs_attributes.txt ./ifs_extracted ./patched_ifs.ifs"
- ⁃ Place patched_ifs.ifs back onto your SD card
Step 7. Create your new FEC file
- ⁃ Open the FEC container (orig_FecContainer.fec) from earlier in your favorite hex editor
- ⁃ Copy VIN from file. This should match your car's VIN, unless component protection is enabled, then it would be the VIN from the donor car
- ⁃ Copy down VCRN (hex values of bytes 16-20 in file). Write it down as shown in the blue highlighted text in the screenshot. The VCRN may be obtained through measurement channels on PIWIS if you only have a 4 byte empty FEC file.
- ⁃ Make a comma separated list of your existing FECs, from offset 0x43 until the checksum begins. Use hex values, add commas at every 4 bytes (8 digits), for example, from screenshot it would be 00030000,00030001,(...),06310099
- ⁃ Add one last FEC to the end of that list, which will enable Android Auto: 00060900
- ⁃ You can also add other FECs to your PCM4 at this time, see below. Additional coding / adaptations may be required.
- ⁃ Download MIB2_FEC_Generator.sh from Github, chmod it to 755
- ⁃ Issue command to generate FEC Container "MIB2_FEC_Generator.sh -f {YOUR_FEC_LIST_CSV} -n {YOUR_VCRN} -v {YOUR_VIN} -d {Output_Directory}"
- ⁃ Output file is FecContainer.fec, copy this new file to your SD card
Step 8. Load new files to head unit
- ⁃ Insert SD card into PCM4, left slot
- ⁃ Login with root / oaIQOqkW
- ⁃ Issue the "stfu" command to stop verbose logging to the terminal.
- ⁃ Remount efs-persist as r/w with command "mount -uw /mnt/efs-persist/"
- ⁃ Copy your new FECs with command "mv /mnt/efs-persist/FEC/FecContainer.fec /mnt/efs-persist/FEC/FecContainer.fec.orig; cp /net/mmx/fs/sda0/FecContainer.fec /mnt/efs-persist/FEC/FecContainer.fec"
- ⁃ Issue commands to flash your stage2 ifs-root... THIS CAN BRICK YOUR HEAD UNIT, SO BE CAREFUL! Important note: "flash.it" is actually one word, but RL censors it, so remove the period otherwise the command won't work.
- ⁃ flashunlock
- ⁃ /usr/bin/flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/patched_ifs.ifs
- ⁃ flashlock
- ⁃ Reboot unit by holding down power button for 30s.
- ⁃ Cross fingers and hope your patch worked
Step 9. Adaptations
- With PIWIS II / PIWIS III, or VCDS
- ⁃ If using PIWIS II, place it into engineering mode via Settings -> Diagnostics Configuration -> 911, 918s, etc... -> Mode -> Select "E". Save + Exit
- ⁃ In PIWIS, Open Diagnostics -> 911 -> 991, scan car (F12) to obtain installed modules, select head unit (Named MIB2...). In VCDS open module 5F
- ⁃ Select "Manuelle Codierung ohne MCR-Regeln" -> Vehicle_configuration
- ⁃ Set Bitfield (3) Google_GAL -> "on"
- ⁃ Save coding, wait for system to reboot
- Alternate method coding through PCM4 shell:
- export LD_LIBRARY_PATH=/mnt/app/root/lib-target:/eso/lib:/mnt/app/usr/lib:/mnt/app/armle/lib:/mnt/app/armle/lib/dll:/mnt/app/armle/usr/lib
- export IPL_CONFIG_DIR=/etc/eso/production
- on -f mmx /eso/bin/apps/pc b:0:3221356628:7.7 1
Step 10. Done!
- ⁃ Plug in your phone. You should now have Android Auto
It is important to note that this hack will be overwritten if you ever decide to perform a software update on your PCM4. You'll then have to re-complete these steps with your new version of software. Given that there are no PCM4 updates available, this will probably be a non-issue.
What if I flash a bad ifs image to my head unit?
⁃ If this happens, MIBRoot will fail to start and you will not be able to interface with PCM4. it will appear to boot from the LCD panel, but touch and audio will not work. However, it will still boot into QNX for recovery since we are only flashing the stage2 image.
⁃ To recover, log into QNX with root / oaIQOqkW
⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4.
⁃ Issue commands:
⁃ flashunlock
⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs
⁃ flashlock
⁃ Note: If stage2 ifs flashing fails, flash.it, flashlock and flashunlock may no longer be present on your system. Copy them to your SD card from your extracted ifs directory and run them from the SD card, for example /net/mmx/fs/sda0/flashunlock.
What if my firmware flash works but I still don't have Android Auto?
⁃ Your VIN, VCRN, or FECs may need to be corrected, review step 7. Cars without CarPlay may need to add FECs 00030000, or 00060700 and 00060800
⁃ If your FECs are being removed from FecContainer.fec and being placed into IllegalFecContainer.fec, then your FECs are failing the signature check. Your patch is wrong and you need to review step 5 again.
⁃ If you did not have CarPlay or Android Auto previously, you may also need to code USB media player functionality within PIWIS II.
What if I want to return to stock?
⁃ Connect to PCM4 via UART
⁃ Log into QNX with root / oaIQOqkW
⁃ Copy your original IFS root file (ifsroot_stage2_orig.ifs) to your SD card and install to left slot of PCM4.
⁃ Issue commands:
⁃ flashunlock
⁃ flash.it -v -x -d -a0x00BA0000 -f/net/mmx/fs/sda0/ifsroot_stage2_orig.ifs
⁃ flashlock
⁃ mount -uw /mnt/efs-persist
⁃ rm /mnt/efs-persist/FEC/FecContainer.fec
⁃ mv /mnt/efs-persist/FEC/FecContainer.fec.orig /mnt/efs-persist/FEC/FecContainer.fec
⁃ Done. Reboot by holding power button for 30s
Code:
#dumpifs_helper.sh IMAGE=$1 TMPDIR=./ EXTRDIR=./ifs_extracted mkdir $EXTRDIR echo "Dumping content of $IMAGE... to $EXTRDIR" dumpifs -z $IMAGE |awk '{print $3}' >$TMPDIR/ifscont.txt dumpifs -z $IMAGE |grep "\->" |awk '{print $3" -> "$5}' >$TMPDIR/ifslinks.txt for i in `cat $TMPDIR/ifscont.txt`; do dirname $i; done |sort -u >$TMPDIR/dirlist.txt for i in `cat $TMPDIR/dirlist.txt`; do mkdir -p $EXTRDIR/$i; done cd $EXTRDIR dumpifs -zx $IMAGE cd ../ echo "done !"
Code:
#Feature Enablement Codes #00030000 # AMI (Enables USB) #00030001 # Gracenote #00040100 # Navigation #00050000 # Bluetooth #00060100 # Vehicle Data Interface #00060200 # Infotainment Control? #00060300 # MirrorLink #00060400 # Performance Monitor (Sport HMI) #00060500 # Sport Chrono #00060600 # Logbook #00060700 # Mobile Online Dienste (Online Services) #00060800 # CarPlay #00060900 # Android Auto #00070100 # SDS #00070200 # SDS for Nav #06310099 #PCM4 Navi
Last edited by chris2; 09-03-2019 at 07:06 PM.
The following 22 users liked this post by chris2:
aigort (09-24-2019),
BoudahXL (09-25-2019),
Buddycz (07-25-2020),
BusDriverBob (08-07-2019),
clubblau (09-24-2019),
and 17 others liked this post.
#94
Racer
Thread Starter
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Thank you for your resume submissive. When would you like to start work? This level of reverse engineering and h4x0ring is impressive. I suspect only a very small handful of people on here understand what you're posting, or what is required to make it work. So the hard part will be trying to make this accessable to the public.. something like an Android App and dongle sold online for $3000 would do the trick.
Now I need to assemble the parts list and see if I have the ***** to hack my own car.
Now I need to assemble the parts list and see if I have the ***** to hack my own car.
#95
Instructor
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Thank you for your resume submissive. When would you like to start work? This level of reverse engineering and h4x0ring is impressive. I suspect only a very small handful of people on here understand what you're posting, or what is required to make it work. So the hard part will be trying to make this accessable to the public.. something like an Android App and dongle sold online for $3000 would do the trick.
Now I need to assemble the parts list and see if I have the ***** to hack my own car.
Now I need to assemble the parts list and see if I have the ***** to hack my own car.
The only part that really needs to be ordered is the UART adapter, other than that you just need a little time.
#96
Rennlist Member
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Thank you Chris2
This is a very important milestone and should be brought out in the wild to make sure Porsche will not attempt to make people believe that Android Auto would only be available on the next-gen models due to hardware restrictions. It is important that the general public doesn't get bullied around by large corporation banking on lack of knowledge.
We got shoved the same BS when supposedly the PCM 4.0 had to use an AT&T SIM card, it is just not true, Porsche is not the only offender out there mind you.
4 cylinders turbo to reduce emissions? In fact it has been proven that the previous 6 cylinder (981) did not produce anymore that the current 718 line, why the lies? The only reason Porsche is reduce the size of their engine is to meet Asian market tax reduction, just google up China engine size related taxes... https://www.iea.org/policiesandmeasu...e-24534-en.php
Knowledge is power.
This is a very important milestone and should be brought out in the wild to make sure Porsche will not attempt to make people believe that Android Auto would only be available on the next-gen models due to hardware restrictions. It is important that the general public doesn't get bullied around by large corporation banking on lack of knowledge.
We got shoved the same BS when supposedly the PCM 4.0 had to use an AT&T SIM card, it is just not true, Porsche is not the only offender out there mind you.
4 cylinders turbo to reduce emissions? In fact it has been proven that the previous 6 cylinder (981) did not produce anymore that the current 718 line, why the lies? The only reason Porsche is reduce the size of their engine is to meet Asian market tax reduction, just google up China engine size related taxes... https://www.iea.org/policiesandmeasu...e-24534-en.php
Knowledge is power.
The following users liked this post:
Porsche_nuts (08-09-2019)
#97
Rennlist Member
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Thank you Chris2
This is a very important milestone and should be brought out in the wild to make sure Porsche will not attempt to make people believe that Android Auto would only be available on the next-gen models due to hardware restrictions. It is important that the general public doesn't get bullied around by large corporation banking on lack of knowledge.
We got shoved the same BS when supposedly the PCM 4.0 had to use an AT&T SIM card, it is just not true, Porsche is not the only offender out there mind you.
4 cylinders turbo to reduce emissions? In fact it has been proven that the previous 6 cylinder (981) did not produce anymore that the current 718 line, why the lies? The only reason Porsche is reduce the size of their engine is to meet Asian market tax reduction, just google up China engine size related taxes... https://www.iea.org/policiesandmeasu...e-24534-en.php
Knowledge is power.
This is a very important milestone and should be brought out in the wild to make sure Porsche will not attempt to make people believe that Android Auto would only be available on the next-gen models due to hardware restrictions. It is important that the general public doesn't get bullied around by large corporation banking on lack of knowledge.
We got shoved the same BS when supposedly the PCM 4.0 had to use an AT&T SIM card, it is just not true, Porsche is not the only offender out there mind you.
4 cylinders turbo to reduce emissions? In fact it has been proven that the previous 6 cylinder (981) did not produce anymore that the current 718 line, why the lies? The only reason Porsche is reduce the size of their engine is to meet Asian market tax reduction, just google up China engine size related taxes... https://www.iea.org/policiesandmeasu...e-24534-en.php
Knowledge is power.
Turning it on w/o validation will never happen from VAG/Porsche.
#98
Instructor
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
The issue probably isn't really that it isn't able to be supported, but that it likely was never tested by Harman or Porsche/Audi/VW. I know for a fact that the vendor that supplies the MIB2 did not test AA on the reference hardware and SW stack.
Turning it on w/o validation will never happen from VAG/Porsche.
Turning it on w/o validation will never happen from VAG/Porsche.
The following users liked this post:
Argote (02-04-2020)
#99
Rennlist Member
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
I was under the impression that MIB2 in VW had android auto since 2016 and that Porsche's official reason for not supporting AA is privacy related (https://news.softpedia.com/news/pors...s-493822.shtml). Perhaps they've dropped that concern, or google changed their policies / struck a deal with Porsche, but in any case, I don't see any technical reason they couldn't sell a retrofit kit & sw upgrade for the 991.2 if they plan on offering it on the 992.
It's really a shame, otherwise I would consider the PCM 4.0 one if not the best multimedia center in any sports car.
#100
Rennlist Member
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
I was under the impression that MIB2 in VW had android auto since 2016 and that Porsche's official reason for not supporting AA is privacy related (https://news.softpedia.com/news/pors...s-493822.shtml). Perhaps they've dropped that concern, or google changed their policies / struck a deal with Porsche, but in any case, I don't see any technical reason they couldn't sell a retrofit kit & sw upgrade for the 991.2 if they plan on offering it on the 992.
![Wink](https://rennlist.com/forums/images/smilies/wink.gif)
#101
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Easily the most impressive hack I've seen. The s/w side of it doesn't scare me much because I'm a s/w geek myself, but at the same time I'm hugely impressed by whoever figured out the hex code offsets to hack.
Hardware-related question - you mention "Step 2. Connect to PCM4 via UART" - does this need me to remove the PCM head unit from the car in order to access it, or is there some kind of access panel to get to the appropriate connectors?
Thanks!
Hardware-related question - you mention "Step 2. Connect to PCM4 via UART" - does this need me to remove the PCM head unit from the car in order to access it, or is there some kind of access panel to get to the appropriate connectors?
Thanks!
The following users liked this post:
Argote (02-04-2020)
#102
Instructor
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
Easily the most impressive hack I've seen. The s/w side of it doesn't scare me much because I'm a s/w geek myself, but at the same time I'm hugely impressed by whoever figured out the hex code offsets to hack.
Hardware-related question - you mention "Step 2. Connect to PCM4 via UART" - does this need me to remove the PCM head unit from the car in order to access it, or is there some kind of access panel to get to the appropriate connectors?
Thanks!
Hardware-related question - you mention "Step 2. Connect to PCM4 via UART" - does this need me to remove the PCM head unit from the car in order to access it, or is there some kind of access panel to get to the appropriate connectors?
Thanks!
Last edited by chris2; 08-10-2019 at 08:23 PM.
#103
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
if you have a USB Ethernet adapter you can start a telnet session to the head unit, but I haven’t tested it. Otherwise for UART you would have to pull the head unit and the UART connection is at the rear of the PCM. It’s just four screws to pull it out from the console. If you're in SoCal and have some time, I'm happy to help
The following users liked this post:
Argote (02-04-2020)
#104
Instructor
![Default](https://rennlist.com/forums/images/icons/icon1.gif)
It is very important to note that connecting over telnet will open a session through the MMX, so we will need to open a telnet connection to the RCC before we can flash the firmware. Opening a telnet session on the RCC directly, via its IP address (10.0.0.16) and port 23 causes the telnet daemon to crash, so we must log in through the MMX at 10.0.0.15 and create a telnet service on an alternate port. See the commands below, I chose port 24 but anything unused should do.
Code:
MacBook:~$ telnet 10.0.0.15 23 Trying 10.0.0.15... Connected to 10.0.0.15. Escape character is '^]'. QNX Neutrino (mmx) (ttyp0) login: root Password: # on -f rcc /net/mmx/usr/sbin/telnetd -debug 24 & [1] 4493435 # bg %1 [1] on -f rcc /net/mmx/usr/sbin/telnetd -debug 24 # exit Connection closed by foreign host. MacBook:~$ telnet 10.0.0.16 24 Trying 10.0.0.16... Connected to 10.0.0.16. Escape character is '^]'. QNX Neutrino (rcc) (ttyp0) login: root Password: ___ _ _ __ __ ___ _____ / |_ _ __| (_) | \/ |_ _| _ \ / /| | | | |/ _ | | | |\/| || || |_)_/ / __ | |_| | (_| | | | | | || || |_) \ /_/ |_|__,__|\__,_|_| |_| |_|___|_____/ / > ls HBpersistence dev hbsystem mnt proc srv var bin eso irc net sbin tmp config etc lib opt scripts usr / >
Also, I should mention that you won't be able to access telnet if you connect PCM4 as a client to your router, so the WiFi Hotspot method probably requires that you have the 4G LTE module optioned. You need to connect your computer to PCM4 either through UART, WiFi Hotspot, FT2xxx USB Serial Cable. or Ethernet.
Last edited by chris2; 08-10-2019 at 10:22 PM.