search

ea / bosch_headunit_root

Documentation and code for rooting and extending a Bosch car head unit (lcn2kai)
398 stars 57 forks source link

other radio models #9

Closed am2222 closed 3 years ago

am2222 commented 3 years ago

Hello, I am interested in this project. I was wondering if this method works on other radio frameworks such as versa note 2015 model or not? It's audio system is similar to this https://www.youtube.com/watch?v=46cw2_ow3qI

Also can we develop some UI applications for the embeded os on such systems?

ea commented 3 years ago

I have no way of confirming this , but from the pictures and model numbers it would appear that this radio is based on LCN2 .0A , with SW: B005 and HW: 018

FCC filings show photos of the internals but are too blurry to distinguish any actual components https://fccid.io/YBN-LCN20A/Internal-Photos/09-internal-photos-1763882

That being said, it looks to be very close to the already tested platforms. The "full exploit" and GPS logger might not work out of the box, but testing for the same vulnerability should be easy.

You could try testing it yourself: https://github.com/ea/bosch_headunit_root/blob/main/docs/rootshell_howto.md#testing-on-other-models

I would love to know if it works but have no way of testing it myself and can't offer any guarantees.

Cheers!

am2222 commented 3 years ago

@ea Thanks for the information. I am willing to test it and will let you know about the update. My problem is that I could not get into service menu yet. I am not sure what is the method to get to the service menu on this model.

am2222 commented 3 years ago

@ea I tried your method but the headunit does not restart when I connect the usb. I am not sure if I am doing it wrong or that model does not have such vulnerability.

ea commented 3 years ago

did the head unit give out any notification at all? Maybe about a file system being unsupported or something ?

am2222 commented 3 years ago

@ea Yeah actually it gave me an error to check your iphone or usb drive which seems it cannot recognize the file system. right?

ea commented 3 years ago

That's what I'd expect. On my lcn2kai, underlying linux system supports the ext2 FS that the scripts create, so it can be mounted, but the multimedia application doesn't handle it and complains about it not being supported, probably in a similar manner to yours.

As I mention in the other document, a slight difference in the udev scripts might make the exploit fail so some additional trial and error might be required. I don't have a way of testing this. A copy of the firmware or firmware upgrade might be useful.

am2222 commented 3 years ago

@ea How can we find the firmware copies? is there any way to find them?