bousqi / SMEG_PLUS

SMEG+ Unit reverse engineering
42 stars 7 forks source link

Harmony #1

Open alexmayo opened 5 years ago

alexmayo commented 5 years ago

Hi!

First of all - great work on unpacking SMEG PLUS! I have a 2017 DS4 and have been spending the past few weeks trying to alter the Harmony 'Rubis' using an update USB stick. I can change the image within the harmony, however once it is packed up and placed onto a USB stick, the system does now allow the update to complete, most likely because the CRC no longer validates. Could you explain how I could go about generating the CRC found within BIG_SKIN_NAV.bin.inf that is located within HARMONY/BigHarmony_6 in the latest update file for SMEG +IV2?

Best, Alex

alexmayo commented 5 years ago

@bousqi 👍

bousqi commented 5 years ago

Hi @alexmayo

Sorry for the late response, I've been quite busy. I'm quite interested in your work for updating Harmony themes from USB stick. I never checked at SMEG+iV2, and I don't know if firmwares are similars or totally differents.

Do you have to links to share on the procedure to perform what you have been doing ? If I understand you correctly, you have been have to partially update some theme file on your unit, however due to CRC issues you can't change all of them ?

You mention BIG_SKIN_NAV.bin.inf as one file for which you failed to compute CRC. On which other files have you been able to succesfully compute CRC.

How do you perform the file update ? through a file structure on a token with UpgPlugin.out ? Or have you been installing manually files through the telnet connection ?

alexmayo commented 5 years ago

Hey @bousqi! Thanks for the response.

The SMEG+iv2 seems to be identical in file structure, the only thing is that since an update from 2017 the telnet connection is permanently closed.

So far I have only tried updating the system via a usb stick directly into the car and have had no success at all as I have been unable to figure out how to generate the correct crc for the files. The update fails as soon as a file is modified, since the checksum does not pass validation.

The latest firmware can be downloaded from https://mega.nz/#!ZBNxkRpT!Pw7MuZZIvU_jjpVpIerpFftyIzZkILR7Vo1CemllImE

This contains all of the update files. The interesting thing is that it will let you install the update over and over again, even if the version is the same. This means that harmonies, interface sounds can be updated by simply changing the update files and updating.

I am stuck on how to create the CRC files, are you able to explain how you do it? I would love to try and change the background of my interface!

Cheers Alex

bousqi commented 5 years ago

Ok got it. First of all, I guess you are aware that it might brick your unit. I'm not willing to scare you but changing some stuff there and there might finally lead to some issues. But to be honest, SMEG devs must have been smart enough to allow a corrupted firmware to be reinstalled correctly.

That being said, from what I've seen in the Update Process analysis, is that there are many files that are aimed to check the firmware integrity even before the update. One first layer is the CRC, but some other files are also used to even double check. So updating the CRC might not be enough. But could be. To be tested. I can't check right now, but if you check on www.gpspower.net forum, you must be able to retrieve the tools to compute those strange CRC. It must be called RTxCRC (just google it). Check if this one solves your CRC issue, try on one untouched file. It must compute you the same CRC as the one written in .inf file.

alexmayo commented 5 years ago

Great thank you! Yes I plan to compute the CRC for the harmony files first and check that it comes back with the correct result.

If it does, I will try changing the image slightly and saving in the exact same format.

I will have a play this weekend and let you know how it goes!

alexmayo commented 5 years ago

I have started a list of useful tools I am finding, and instructions on how to use them: https://github.com/alexmayo/SMEG_PLUS/tree/master/tools

P208PUG commented 4 years ago

The telnet connection is still possible with fw 6.4.xx , but you need connect with rs2ttl dongle to the board...

here upgrade log to 6.4

https://pastebin.com/FvmheRi3