Audi A6 4G MIB Head Unit HIGH

[paskuale]

Hello to all forum member !
I open this thread to talk about the new MMI 3GP unit that equipped the Audi A6 4G Facelift (4G1035044)
Can we talk about differences and similarities from previus head unit 3GP (4G0035666-670).

Does it have an internal eeprom where are stored information about CP, coding, part number ?
It's possible to read internal eeprom like previus generation ?

It's true that after firmware upgrade MIB units need always CP unlock ?

Does this unit have internal Radio Tuner ?

If someone has other info, please talk here about.

I'm sorry if I write in english, but I can't speak Russian Language.
I will traduce with Google Translator for the Russian Friends and apologies for some mistakes due using translator :)

Best Regards

------------------------------------------------------------------
Привет всем участником форума!
Я открываю эту тему, чтобы поговорить о новом блоке MMI 3GP, что оборудовал Audi A6 4G Facelift (4G1035044)
Можем ли мы говорить о сходствах и различиях от закупочных руководитель отдела 3GP (4G0035666-670).


Есть ли у внутреннюю EEPROM, где хранятся сведения о CP, кодирование, номер детали?
Это можно прочитать внутреннюю EEPROM как закупочных поколения?


Это правда, что после обновления прошивки MIB единицы должны всегда разблокировки CP?

Есть ли у этого подразделения внутренней радио-тюнер?

Если кто-то имеет другую информацию, пожалуйста, здесь говорить о.


Я извиняюсь, если я пишу на английском языке, но я не могу говорить на русском языке.
Я злословить с Google Переводчик для российских друзей и извинения за ошибки вследствие помощью переводчика :)


С Уважением

[MMI]

Привет,


Кто знает, какие кнопки нажимать для получения "зеленых меню"?


Активация делается, только нормальные кнопки не работают для зеленых человечков
и.


Спасибо и уважением,


Рой

[audijiJQ]

I have seen in other places, to enable development mode 5F, and then enter the green menu The middle section, you may need to use "MENU" button to replace the "BACK" button
36396

[audijiJQ]

Memory read the script already have it?

[paskuale]

Someone tests the audijiJQ procedure ?
I think it will work for Audi A3 8V, because MIB for A6 4G has the same panel command as first 4G.

No any news avaible at moment ?

--------------------------------------------------------------------
Кто-то испытывает процедуру audijiJQ?
Я думаю, что это будет работать для Audi A3 8V, потому что MIB для A6 4G имеет ту же самую команду панели, как первый 4G.


Нет никаких новостей доступна в данный момент?

[audijiJQ]

Someone tests the audijiJQ procedure ?
I think it will work for Audi A3 8V, because MIB for A6 4G has the same panel command as first 4G.

No any news avaible at moment ?

--------------------------------------------------------------------

Кто-то испытывает процедуру audijiJQ?
Я думаю, что это будет работать для Audi A3 8V, потому что MIB для A6 4G имеет ту же самую команду панели, как первый 4G.


Нет никаких новостей доступна в данный момент?


Sorry, A6 MIB operation panel does not change, I ignore this; it should still "CAR" and 'MENU "combination, but first you have to enable the development of pattern matching, such as images inside as marked.:)

[MMI]

HI,


Любой, кто может изменить сценарии для захоронения APP? Свое основанное на тех же системах, как 3G и + так что только файловая система отличается.


Таким образом, то, что существуют sripts можно использовать, они должны быть изменены.


С Уважением,


Рой

[paskuale]

We need new login too I think !
VCP can do VIM on this unit, so I think that login is avaible...

[MMI]

Hi,

Can anybody tell me if i "need" to write in russian or will English do ?

Anyway, this login is the same as MIB A3 8V I guess.

I will have some testing units here next week, i will post info when i have it.

I would need some help on the DES hash with the password to have root acces.

Regards,

Roy

[Tschako]

@ Pascuale:
VCP and Others using the known EOL-Login for coding MIB units: 20103
But the Engineering Mode Login Other Needs an ... somebody with news ?? Lets share Our ​​Knowledge!
@ MMI: What kind of Activation you Talk About ??

[audijiJQ]

@Tschako I use 20103 Log MMI system, suggesting that access authorized to be accepted, but hidden match channel 48 is still not open.It appears to only be used in MIB system, right?

[MMI]

Hi,

The activation of the "green menu", i think there are 2 menu's green, or, the rest of the content of the green menu needs to be activated. I have lots of units here and also some test units, they all have green menu but only the test unit has the coding options for the settings in the car as we are used to in the 3G(+) units. So my guess is that this "important" settings for us are hidden or in other menu.

Regards,

ROy

[MMI]

Hello,

Anybody knows the checksum algo's used in the META file for the MIB update SD cart ? I do not mean the CRC32 for the metafile it self but for the calulation of checksum of let say EFS-PERSIST.IMG, in meta file there are 8 checksums for that file.

Regards,

Roy :confused::D

[bertelsmann]

FW MIB
uses Sha1 Algo But at the end of the file there is A (RSA) Signature (128 bytes) That is Probably the dealbreaker :-( regards

[bertelsmann]

btw
does anybody have an idea what format the ifs-images
in the MIB Firmware updates are ?!
They look encrypted to me

[audijiJQ]

yes it's use SHA1 ,but some checksum is not right,and one file has multiple checksum

Most files have a cryptographic signature, including the map files and FSC documents

[MMI]

@ bertelsmann, you think you can recalculate the checksums ?

Regards,

Roy

[bertelsmann]

checksum recalculation is no problem at All
Just Spit it into 512 kbyte blocks

openssl dgst -sha1 block1
openssl dgst -sha1 block2
...
does all you need

but the problem is probably the signature block at the and of the metafile
seems to me like a rsa signature
probably it is the metafileChecksum (20 bytes)
rsa signed with a 1024 bit private key
the corresponding public key has to be in the unit

but without the private key ... well ...

[audijiJQ]

MIB system IFS-ROOT.IFS DUMPIFS command can be used directly. This is what I get the table of contents, but I do not know how to extract the files to a designated place.

Offset Size Name 0 8 *.boot
8 100 Startup-header flags1=0x9 flags2=0 paddr_bias=0
108 22008 startup.*
22110 5c Image-header mountpoint=/
2216c 34cc Image-directory
---- ---- Root-dirent
---- ---- mnt/ifs-root/usr/apps/config
---- 1a lib/libcpp-ne.so.4 -> /proc/boot/libecpp-ne.so.4
---- 16 usr/lib/factories/libbrokerproxy.so -> /lib/libbrokerproxy.so
---- 21 usr/lib/factories/libasirccpersistenceproxy.so -> /lib/libasirccpersistenceproxy.so
---- 19 usr/lib/factories/libasirccrvcproxy.so -> /lib/libasirccrvcproxy.so
---- f usr/lib/libcomm.so -> /lib/libcomm.so
---- 1d usr/apps/config -> /mnt/ifs-root/usr/apps/config
---- 24 opt/sys/lib/libsys_dsi_colibry.so.2 -> /opt/sys/lib/libsys_dsi_colibry.so.3
---- 2a opt/sys/lib/libsys_dsi_servicebroker.so.1 -> /opt/sys/lib/libsys_dsi_servicebroker.so.2
---- 22 opt/sys/lib/libsys_dsi_trace.so.2 -> /opt/sys/lib/libsys_dsi_trace.so.3
---- 2a opt/sys/lib/libsys_trace_clienttrace.so.3 -> /opt/sys/lib/libsys_trace_clienttrace.so.4
---- 26 lib/libSysMoCCAFrameworkSharedSo.so.5 -> /lib/libSysMoCCAFrameworkSharedSo.so.6
---- 13 lib/libsocket.so.2 -> /lib/libsocket.so.3
---- 8 bin/rz -> /bin/lrz
---- 9 dev/serkeypanel -> /dev/null
---- a tmp -> /dev/shmem
---- 9 dev/console -> /dev/ser1
---- 8 bin/sh -> /bin/ksh
25638 96b etc/symlinks.cfg
25fa3 56 etc/system/enum/include/net
26000 8a000 proc/boot/procnto-j5-instr
b0000 610 proc/boot/.script
b0610 7f3 etc/mib_i2c.cfg
b0e03 1f8 etc/mib_spi2_VICS.cfg
b1000 170 proc/boot/serverstarterboot
b1170 c04 etc/system/enum/include/usb-class
b1d74 25f etc/mib_spi3.cfg
b1fd3 29 etc/version/ifs-root-version.txt
b2000 144 proc/boot/start_pcie_cbc
b2144 aad etc/inetd.conf
b2bf1 350 etc/mib_spi0.cfg
b2f41 be etc/group
b3000 88 proc/boot/server.cfg
b3088 f33 usr/bin/modifyPackage.sh
b3fbb 44 etc/qnet_hosts
b4000 c etc/mib_C1
b400c 765 etc/system/enum/devices/usb/net
b4771 699 etc/NavPositioning.hbtc
b4e0a 1f1 etc/devc-navsens.config
b5000 299c proc/boot/mkprocsymlinks
b799c 502 etc/mcd.cfg
b7e9e 158 usr/bin/startup_problems_debug.sh
b8000 77000 proc/boot/libc.so.3
---- 9 proc/boot/libc.so -> libc.so.3
12f000 9fdaf bin/io-pkt-v4
1cedaf 249 etc/profile
1cf000 19059 bin/ifconfig
1e8059 2db etc/system/enum/devices/usb/char
1e8334 2cc usr/bin/hbhogs
1e8600 235 etc/mib_spi2_DAB.cfg
1e8835 217 mnt/ifs-root/usr/apps/config/tracing.json
1e8a4c 210 usr/bin/dhcp_ifconfig.sh
1e8c5c 1e8 etc/system/enum/devices/usb/mass
1e8e44 18d usr/bin/mount_efs_rw.sh
1e8fd1 26 usr/bin/stfu
1e9000 541f bin/if-test
1ee41f 1da usr/bin/stop_efs_driver.sh
1ee5f9 16a mnt/ifs-root/usr/bin/mocca_watchdog_warn_dump.sh
1ee763 141 etc/system/enum/common
1ee8a4 130 bin/login
1ee9d4 128 etc/passwd
1eeafc ff usr/bin/set_variant.sh
1eebfb fe etc/version/RCC-version.txt
1eecf9 eb etc/suid_profile
1eede4 b6 etc/mcd.mnt
1eee9a a2 etc/system/enum/include/block
1eef3c 9b etc/version/version.txt
1eefd7 26 mnt/ifs-root/usr/apps/config/probes.json
1ef000 6218 usr/sbin/tracelogger
1f5218 89 etc/cfmem.cfg
1f52a1 70 mnt/ifs-root/usr/bin/mocca_watchdog_timeout_dump.sh
1f5311 62 etc/hosts
1f5373 54 usr/bin/DAB_Enable.sh
1f53c7 1b etc/shadow_rcc
1f53e2 16 mnt/ifs-root/usr/apps/config/dsiagentmapping.json
1f6000 10c5c sbin/devc-seromap
207000 7e78 lib/dll/devnp-mib-rcc.so
20f000 2e719 lib/libsocket.so.3
---- e lib/libsocket.so -> libsocket.so.3
23e000 33e4f lib/dll/lsm-qnet.so
272000 3c04 usr/bin/rcc-pcie-init
276000 41bb sbin/slogger
27b000 81cf sbin/route
284000 59b1 usr/bin/setconf
28a000 60a1 bin/waitfor
291000 653f bin/dsploader
298000 25f0 usr/sbin/if_up
29b000 45bf bin/mount
2a0000 41d68 bin/ksh
2e2000 13270 bin/lrz
2f6000 13ff8 bin/lsz
30a000 5653 bin/ls
310000 355b bin/ln
314000 2be7 bin/sloginfo
317000 36ce bin/chmod
31b000 836ce lib/libcomm.so
39f000 4cd7 lib/libdsicommon.so
3a4000 3c6cb lib/libiplcommon.so
3e1000 5c79e lib/libosal.so
43e000 18d40 lib/libprobes.so
457000 7699 lib/libprobesTraceMessageBackend.so
45f000 a3cc lib/libprobesTracingBackend.so
46a000 6d9ed lib/libtracing.so
4d8000 ab398 lib/libunicodestring_data.so
584000 8e6ee lib/libutil.so
613000 4816 lib/libasirccrvcproxy.so
618000 ec64 lib/libasirccpersistenceproxy.so
627000 c2fd lib/libbrokerproxy.so
634000 26f29 proc/boot/libm.so.2
---- 9 proc/boot/libm.so -> libm.so.2
65b000 1d8c8 proc/boot/libecpp-ne.so.4
---- f proc/boot/libecpp-ne.so -> libecpp-ne.so.4
679000 5ccc bin/exec_login
67f000 247b bin/cat
682000 3252 bin/mv
686000 9fb2 bin/cp
690000 323d bin/rm
694000 2cb5 bin/mkdir
697000 67c0 bin/df
69e000 318a bin/du
6a2000 531b sbin/pipe
6a8000 845d sbin/enum-devices
6b1000 5842 sbin/enum-usb
6b7000 b152 sbin/devb-umass
6c3000 1d3c1 sbin/devc-serusb
6e1000 60a1 bin/on
6e8000 1346f bin/pidin
6fc000 207e bin/sleep
6ff000 15ed7 sbin/dumper
715000 9a3b sbin/mcd
71f000 10357 bin/ircCtrl
730000 4c5c bin/slay
735000 1ddb bin/umount
737000 18ef8 usr/sbin/fs-cifs
750000 113c7 usr/sbin/dhcp.client
762000 50d7 usr/sbin/nicinfo
768000 ffa2 sbin/devc-pty
778000 b0b1 usr/bin/pdebug
784000 b465 usr/sbin/inetd
790000 37c89 sbin/devf-generic
7c8000 4c61 usr/bin/flashctl
7cd000 3cd3 usr/bin/flashit
7d1000 421b usr/bin/flashmib
7d6000 11334 usr/bin/checkFreeMem
7e8000 2a8f usr/bin/mib_dumper
7eb000 acdb usr/bin/grep
7f6000 29af usr/bin/touch
7f9000 538e usr/bin/use
7ff000 57cb usr/bin/hogs
805000 affe usr/bin/ping
810000 1df21 usr/bin/netstat
82e000 bb2e usr/bin/qkcp
83a000 59b1 usr/bin/setconf
840000 4aaf usr/bin/date
845000 1f675 sbin/io-usb
865000 b8c6 lib/libusbdi.so.2
---- d lib/libusbdi.so -> libusbdi.so.2
871000 2572a sbin/servicebroker
897000 9c14 lib/dll/devnp-shim.so
8a1000 d54f lib/dll/devn-asix.so
8af000 13d6e lib/libcam.so.2
---- b lib/libcam.so -> libcam.so.2
8c3000 229a1 bin/starter
8e6000 46d0 lib/dll/cam-disk.so
8eb000 5c40 lib/dll/cam-cdrom.so
8f1000 2b7ba lib/dll/io-blk.so
91d000 15da0 lib/dll/fs-dos.so
933000 e436 lib/dll/fs-cd.so
942000 fe51 lib/dll/fs-qnx4.so
952000 14700 lib/dll/fs-qnx6.so
967000 14ff2 bin/watchdog
97c000 11a44 usr/lib/libz.so.2
---- 9 usr/lib/libz.so -> libz.so.2
98e000 5061 usr/lib/libbacktrace.so.1
---- 11 usr/lib/libbacktrace.so -> libbacktrace.so.1
994000 5dc4 usr/lib/libfileupload.so
99a000 2000 lib/libwdgadapter.so.1
---- 12 lib/libwdgadapter.so -> libwdgadapter.so.1
99c000 818d lib/libheartbeat.so.3
---- 11 lib/libheartbeat.so -> libheartbeat.so.3
9a5000 6000 opt/sys/lib/libsrm_client.so
9ab000 7000 opt/sys/lib/libsrm_client_cmd.so
9b2000 11000 opt/sys/lib/libsnoopy.so
9c3000 1e000 opt/sys/lib/libsys_trace_clienttrace.so.4
---- 1d opt/sys/lib/libsys_trace_clienttrace.so -> libsys_trace_clienttrace.so.4
9e1000 b000 opt/sys/lib/libsys_dsi_trace.so.3
---- 15 opt/sys/lib/libsys_dsi_trace.so -> libsys_dsi_trace.so.3
9ec000 5000 opt/sys/lib/libsys_dsi_servicebroker.so.2
---- 1d opt/sys/lib/libsys_dsi_servicebroker.so -> libsys_dsi_servicebroker.so.2
9f1000 1e000 opt/sys/lib/libsys_dsi_colibry.so.3
---- 17 opt/sys/lib/libsys_dsi_colibry.so -> libsys_dsi_colibry.so.3


d5d000 1165bc usr/apps/NavigationPositioning
e74000 79cc usr/apps/setVariant
e7c000 90ac usr/apps/startVariant
e86000 1a6c usr/apps/iocBootMode
e88000 2c40 usr/apps/flashReader
e8ac40 ef9f etc/srv-starter.cfg
e99bdf 3a8a usr/lib/factories/symlink.config
e9d669 3211 etc/IRCConfig.cfg
ea087a 2fef mnt/ifs-root/usr/apps/config/framework.json
ea3869 1b9f etc/dev-InicServer-mib-C1.cfg
ea5408 1987 etc/sysregs-jacinto-mib.cfg
Checksums: image=0xaf377e04 startup=0x1860b9d

[audijiJQ]

Friends, do you have a Chinese version of MIB firmware?

[bertelsmann]

Hi,

what version of firmware are you using ?
What is the path to the root-ifs.img (int the firmware) you dumped on your previous post ?

MHIG_EU_AU_P1531/MMX1/mifs-stage1/40/default/mifs-stage1.img
MHIG_EU_AU_P1531/MMX1/mifs-stage2/40/default/mifs-stage2.img

these can not be dumped using dumpeifs - at least i don't know how

regards

[audijiJQ]

I used this command : dumpifs - x ifs-root. ifs, the results suggested that : " Unble to open etc/symlinks.cfg : No Such file Or Directory "

[bertelsmann]

which firmware ?
in recent MIB Firmware there is NO ifs-root. IFS in the MMX directory !

[audijiJQ]

Hi,what version of firmware are you using ?What is the path to the root-ifs.img (int the firmware) you dumped on your previous post ?MHIG_EU_AU_P1531/MMX1/mifs-stage1/40/default/mifs-stage1.imgMHIG_EU_AU_P1531/MMX1/mifs-stage2/40/default/mifs-stage2.imgthese can not be dumped using dumpeifs - at least i don't know howregardsE:\MHIG_EU_AU_P1531_(A3)\RCC\ifs-root\31\default\ifs-root.ifs

[audijiJQ]

I need a firmware in China

[audijiJQ]

release = "MHIG_EU_AU_P1531"
MUVersion = "0356"
vendor = "HARMAN (HAD)"
variant = "FMU-H-N-EU-AU*"
variant2 = "FMU-H-TN-EU-AU*"
variant3 = "FMU-H-TNL-EU-AU*"
variant4 = "FMU-H-ND-EU-AU*"
variant5 = "FMU-H-TND-EU-AU*"
variant6 = "FMU-H-TNDL-EU-AU*"
region = "Europe"
delMmeBackup = "true"
MaxParallelDevices = "2"
ExclusiveUpdate = "AMP12_APN,CINTERION,CINT-LTE,DUA201,DVD,FC1H37xE,KBD_FA3H,GPS,TELIT,Tuner"
FinalScript = "./common/tools/0/default/finalScript.sh"
FinalScriptName = "Final Script"
FinalScriptChecksum = "e96f9282abd730c385a912a094e92d18a2fd5e26"-----I calculate the checksum and the same
FinalScriptMaxTime = "20"
MetafileChecksum = "ec75d57a2ec2d94c267abd987a866b7fdef9607d"-------I cannot compute the checksum is correct

[audijiJQ]

I search a bit, as if made by RSA+32 - Bit hash is encrypted

Since the document was handed over to J794 to read, then the public key inside the J794

So the private key???

It's like FSC, we only know the public key in J794, no one knows the private key

If someone knows they will never be said? The leak, is illegal

[Crash-100]

may be you need this

[bertelsmann]

:-)
the word public in the key's name says it all
if you find the same files with "private" instead of public
please post it :-)

[audijiJQ]

may be you need this


My friend，All public key

But,Your product a lot:D

[malec]

Hi!

Is there any chance that someone can share the firmware update? MHIG_EU_AU_P1531

Thanks!

[malec]

Hello!

Nobody shared the FW update, I don't know why..
I managed to find it on different forum. Some help for you for the moment:
Emergency boot root password is "harman_f"

If you already knew it, maybe you can share the normal boot root password.

Regards!

[hrdinaveliky]

Maybe use solution on VW site for POI update:
Metainfo2.txt:
################################################## ###############################
#
# This is the description file for the Software Update of Volkswagen components
#
################################################## ###############################

[common]
skipSaveTrainName = "true"
vendor = "ESO"
skipCheckSignatureAndVariant = "true"
region = "Europe"
region2 = "RoW"
region3 = "USA"
variant = "FM?-H-*-*-*"
release = "2012/2013"
UserSWDL = "true"
skipMetaCRC = "true"
MetafileChecksum = "3eae301545686f06bcf04e896a1e98e1f1340458"
skipFileCopyCrc = "true"
[PersonalPOI]
VendorInfo = "ESO"
DeviceDescription = "Personal POI Packages"
ConfigComponent = "PersonalPOI"
PacketName = "Package"
ConfigCheckPath = "PersonalPOI/Package/0/default"
ConfigFinalizePath = "/net/mmx/mnt/navdb/PersonalPOI/Package"
IncludeModules = ",Package,"
[PersonalPOI\Package\0\default\Dir]
CheckSumSize = "524288"
CheckSum = "51f3f6ea627c19fb640d1bcdfb7f3787c325dc3c"
FileSize = "198486"
CheckType = "CheckReadData"
DeleteDestinationDirBeforeCopy = "true"
Version = "1"
UpdateOnlyExisting = "false"
IsDestinationInFFS = "false"
Source = ""
Destination = "/net/mmx/mnt/navdb/PersonalPOI/Package"
DisplayName = "Personal POIs"
[PersonalPOI\InfoFile\0\default\File]
CheckSumSize = "524288"
CheckSum = "1abf1ee7e070c8faf74e774f0991733f0d59835a"
FileSize = "640"
Version = "3"
Source = "Update.txt"
Destination = "/net/mmx/mnt/navdb/PersonalPOI/Update.txt"
DisplayName = "Database Information"
DeleteDestinationDirBeforeCopy = "true"
UpdateOnlyExisting = "false"

[spyderboyant]

Does anyone know which cars these MIB2 updates are for? I have collected the following information as I am trying to find updates for a Q7 4M. Factory was 0358, then 422, 678 and now 917 with SQ7



SD Card Name (ETKA)
Release
MIB Ver
VARIANT
Vehicle



4M0906961

P0040

A6


4M0906961A
MHI2_ER_AUG24_K1068
1068

TT3


4M0906961B
MHI2_ER_AUG22_K2140_1
358
Harman (HAD)
Q7


PRODUCTION FACTORY
MHI2_ER_AUG22_P2133
358
Harman (HAD)
Q7


PRODUCTION FACTORY
MHI2_ER_AUG22_P3241
678
Harman (HAD)
Q7


PRODUCTION FACTORY
MHI2Q_ER_AUG22_P3638
917
Harman (HAD)
SQ7


4M0906961C
MHI2_ER_AU57x_K2519_2
389
Harman (HAD)
A6/A7


4M0906961D






4M0906961E






4M0906961F






4M0906961G






4M0906961H
BDT_AU536_0165
165

Q7


4M0906961J






4M0906961K






4M0906961L






4M0906961M






4M0906961N
MHS2_EU_AU_K0129
159
DELPHI
A4/A5


4M0906961P
MHS2_ER_AU_K0465
175

Q2/B9/A3


4M0906961Q
MHI2_ER_AU57x_K2570
924
Harman (HAD)
A6/A7


4M0906961R






4M0906961S






4M0906961T






4M0906961AA






4M0906961AB






4M0906961AC






4M0906961AD






4M0906961AE






4M0906961AF






4M0906961AG






4M0906961AH

[nikolajse]

latest:

4M0906961AJ
4M0906961AK
4M0906961AL
4M0906961AM
4M0906961AN

[nikolajse]

No - I can just see that they can be ordered...

[congo]

That's true ... but in the end of the file you will find digital signature :)
And that's something you cant calc.

[Egon]

4M0906961Q SD Card:

35eur, any audi dealer.

1\metainfo2.txt
2\metainfo2.txt
metainfo2.txt

59219

[herr.frei]

Egon, are you able to provide us the whole SD card image? This would be fine!

Herr Frei

[congo]

Does anyone have IOC app image version 8285 ?
Regards.

[zloybob]

I have 8283. Work perfect with SW 910 A6

[Crash-100]

это с карты обновления ?

[zloybob]

ага

[Crash-100]

а какой номер ?

[congo]

I dont think SD card exist yet ... unless it's P/R version which is not from dealer but from factory.

[zloybob]

Ну да, флешки с софтом нет. Но приходится выкручиваться, чтоб обновлять головы для апп коннекта =)

[congo]

That's what i did.

[Crash-100]

Ну да, флешки с софтом нет. Но приходится выкручиваться, чтоб обновлять головы для апп коннекта =)
кто-то путается в показаниях.

[zloybob]

кто-то путается в показаниях.

Да я не так прочитал первый раз.

[pepeEL]

Hi all
I have a question. Where in MMI 3G High and Basic is implement language menu ? In file ifs-root.ifs ? But how i can edit this files to implement/change language to my country...? I want do translation. And then how calculate again correct checksum metainfo ? Please help me.

[congo]

Someone have 7466 and 8763 IOC firmware ?

[leader]

Everyone knows in what format the public key is stored in the *_public_signed.bin files?

If the signture is 1024 bits (128bytes) than the public modulus must 1024 bits (128 bytes) too. But here the bytes are stored in 288bytes (in mmi3g the 1024bit public keys is stored on 256byte).
I played many times with openssl and crypto++ but without success...

[congo]

Read that https://reverseengineering.stackexchange.com/questions/12286/defeat-rsa-hash-verification/12287
And pay attention to my comment at the end :)
Regards.

[simaservis1108]

Not necessarily change.
I think I will have 1st version of patch for MIB1/2 around 20th of January.

[leader]

Thanks, I tested it and worked like a charm :)

It was more than enought...

Yet I know everything about fsc and public keys in mmi3g, rns850, MIB1 head units... :)
For mmi3g and rns850 is not to hard to inject own keys and maybe there is one (or maybe two) methods for MIB too...

[leader]

Read that https://reverseengineering.stackexchange.com/questions/12286/defeat-rsa-hash-verification/12287
And pay attention to my comment at the end :)
Regards.

Have you tried this on FEC keys too?
It seems than is working on Data and Metinfo keys (all are the sames) but not on FEC Keys...
And of course the same logic works on MMI3G family too.

[leader]

Have you tried this on FEC keys too?
It seems than is working on Data and Metinfo keys (all are the sames) but not on FEC Keys...
And of course the same logic works on MMI3G family too.

Now I discovered the trick....

FEC files are not self signed. They are signed with Metainfo/Data key...

[congo]

You made it work w/o patch of mibroot or mmi3gapp....?
I’ve tested on metainfo and fec and both don’t work with stock firmware.

[leader]

You made it work w/o patch of mibroot or mmi3gapp....?
I’ve tested on metainfo and fec and both don’t work with stock firmware.

No yet.
Have you recallculated the MetainfoChecksum correctly before sign it?
Have you replaced all 4 Metainfo keys in MIB?
What error message do you receive when try to update the unit?

At the moment I have only mmi3g bnav, hnav, hnav+ on my desk. So I can test only FSC now...

Next step can be to reverse the structure of FecContainer.fec file. I think FEC codes are stored there.

If you send me your new PubKeys and Metainfo than I can help you to doble check them. Two heads are better than one...

What do you mean "mibroot"?

[алексей 3012]

60800

This is the secret key file?

[leader]

60800

This is the secret key file?

I think it must be an important file. If you check the filename it's "maybe" the container file for FeC codes (like in RMC where FSC are stored in Container too).
If you reverse the fec binary in IDA you can found some FeC related functions to handle FeC requests....

Currently I have only 2 fec container files from 2 different devices. One is empty (contains only 4 bytes header) and other has some data inside.
Next days. I will try to get more container files to check them....
I don't know (but I hope) if I'm on the right way....

[jvkk]

I have one FecContainer.fec from VW's discover pro (MIB2HIGH). I did some basic check... The file size should be 4 + (195 x FeC counts). The first 4 bytes means how much FeCs inside the container.
For each FeCs, Start with 0x000000AB and end with 0x000000FF (little endian)
For each offset of individual FeCs
byte00 ~ byte03: 0x000000AB
byte04~ byte05: 0x0211
byte06 ~ byte09 : FeCs in big endian (i.e. FeC 0931002f would be 09 31 00 2f)
byte11 ~ byte15 : VCRN code
byte16 ~ byte33 : VIN + \0 (18bytes)
byte34 ~ byte37 : Date time of the FeCs (Epoch time in big endian)
byte38 ~ byte46 : All 0x00
byte47 ~ byte174 : variant data, signature? (128 bytes)
byte175 ~ byte 178: 0x00000001
byte179 ~ byte182: FeCs in little endian (i.e. FeC 0931002f would be 0x0931002f)
byte183 ~ byte186: 0x00000001
byte187 ~ byte190: 0x00000003
byte191 ~ byte194: 0x000000FF

[leader]

I have one FecContainer.fec from VW's discover pro (MIB2HIGH). I did some basic check... The file size should be 4 + (195 x FeC counts). The first 4 bytes means how much FeCs inside the container.
For each FeCs, Start with 0x000000AB and end with 0x000000FF (little endian)
For each offset of individual FeCs
byte00 ~ byte03: 0x000000AB
byte04~ byte05: 0x0211
byte06 ~ byte09 : FeCs in big endian (i.e. FeC 0931002f would be 09 31 00 2f)
byte11 ~ byte15 : VCRN code
byte16 ~ byte33 : VIN + \0 (18bytes)
byte34 ~ byte37 : Date time of the FeCs (Epoch time in big endian)
byte38 ~ byte46 : All 0x00
byte47 ~ byte174 : variant data, signature? (128 bytes)
byte175 ~ byte 178: 0x00000001
byte179 ~ byte182: FeCs in little endian (i.e. FeC 0931002f would be 0x0931002f)
byte183 ~ byte186: 0x00000001
byte187 ~ byte190: 0x00000003
byte191 ~ byte194: 0x000000FF

Hi jvkk,

It's very usefull infromation.
Thank you for sharing...

I think the 128 bytes must be the signature, because the keys are 1024bits (128 bytes) too.

regards,
leader

[jvkk]

I also found something interesting when I use 'file' to identify content of dumped data...
Is this useful or just no use because it's a public key?
dump/> file HBpersistence/Keys/*/*
HBpersistence/Keys/DataKey/AU_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/BY_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/PO_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/SE_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/SK_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/VW_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/FECKey/AU_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/BY_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/PO_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/SE_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/SK_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/VW_MIB-High_FEC_public_signed.bin: PGP\011Secret Sub-key -
HBpersistence/Keys/MetainfoKey/AU_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/BY_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/PO_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/SE_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/SK_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/VW_MIB-High_MI_public_signed.bin: data

[leader]

I also found something interesting when I use 'file' to identify content of dumped data...
Is this useful or just no use because it's a public key?
dump/> file HBpersistence/Keys/*/*
HBpersistence/Keys/DataKey/AU_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/BY_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/PO_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/SE_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/SK_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/VW_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/FECKey/AU_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/BY_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/PO_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/SE_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/SK_MIB-High_FEC_public_signed.bin: data
HBpersistence/Keys/FECKey/VW_MIB-High_FEC_public_signed.bin: PGP\011Secret Sub-key -
HBpersistence/Keys/MetainfoKey/AU_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/BY_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/PO_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/SE_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/SK_MIB-High_MI_public_signed.bin: data
HBpersistence/Keys/MetainfoKey/VW_MIB-High_MI_public_signed.bin: data

These files contains the public keys to check signature in FEC, Metainfo and data files....

[spyderboyant]

Any update on this? Any way to add FSC to FecContainer.fec

[spyderboyant]

Any further break throughs? I have Q7 FecContainer.fec that is 227 bytes in size. VIN starts at byte 20 and it has 5 FeC codes... Wondering how this compares to jvkk.

[spyderboyant]

What I have been able to deduce:

Bytes 00-03 01 00 00 00
Bytes 04-19 B7 00 00 00 11 07 FF FF FF FF 03 61 69 DE D4 A7
Bytes 20-37 VIN + 00 (18 bytes)
Bytes 38-42 56 4F 19 4F 05
Bytes 43-46 FeC #1 Big Endian
Bytes 47-50 FeC #2 Big Endian
Bytes 51-54 Fec #3 Big Endian
Bytes 55-58 Fec #4 Big Endian
Bytes 59-62 FeC #5 Big Endian
Bytes 63-79 85 18 6F 42 EA D4 9B CD B1 D8 4F E3 F0 64 7E 13
Bytes 80 - 95 A3 84 37 24 B3 05 34 67 DD 05 DB A5 DC 18 97 5B
Bytes 96 - 111 A3 F5 C9 74 29 4D 55 23 E4 85 8D B0 81 AB CB 9D
Bytes 112 -127 AC 95 39 6F 46 39 7A E5 00 88 E3 7B 24 C9 69 D5
Bytes 128 - 143 30 8B BD D2 9A A8 05 A4 01 A2 09 6F 92 30 87 69
Bytes 144- 159 0B 59 F0 44 33 6C B2 8E 99 20 3B 8E 4B FE F7 EC
Bytes 160 - 175 B3 6C 7B 3D 79 DA B7 FE 9A ED 97 B0 D0 DD 60 25
Bytes 176 - 191 73 16 BB 40 3F A4 5C 4F E2 75 B1 6E 39 F8 6E 05
Bytes 192 - 194 00 00 00
Bytes 195-198 FeC #1 Little Endian
Bytes 199-202 FeC #2 Little Endian
Bytes 203-206 Fec #3 Little Endian
Bytes 207-210 Fec #4 Little Endian
Bytes 211-214 FeC #5 Little Endian
Bytes 215 -226 01 00 00 00 03 00 00 00 FF 00 00 00

[spyderboyant]

Further

Bytes 00-03 01 00 00 00
Bytes 04-19 B7 00 00 00 11 07 FF FF FF FF 03 61 69 DE D4 A7
Bytes 20-37 VIN + 00 (18 bytes)
Bytes 38-42 56 4F 19 4F Epoch time
Byte 42: 05 #Number of FeCs
Bytes 43-46 FeC #1 Big Endian
Bytes 47-50 FeC #2 Big Endian
Bytes 51-54 Fec #3 Big Endian
Bytes 55-58 Fec #4 Big Endian
Bytes 59-62 FeC #5 Big Endian
Bytes 63-79 85 18 6F 42 EA D4 9B CD B1 D8 4F E3 F0 64 7E 13
Bytes 80 - 95 A3 84 37 24 B3 05 34 67 DD 05 DB A5 DC 18 97 5B
Bytes 96 - 111 A3 F5 C9 74 29 4D 55 23 E4 85 8D B0 81 AB CB 9D
Bytes 112 -127 AC 95 39 6F 46 39 7A E5 00 88 E3 7B 24 C9 69 D5
Bytes 128 - 143 30 8B BD D2 9A A8 05 A4 01 A2 09 6F 92 30 87 69
Bytes 144- 159 0B 59 F0 44 33 6C B2 8E 99 20 3B 8E 4B FE F7 EC
Bytes 160 - 175 B3 6C 7B 3D 79 DA B7 FE 9A ED 97 B0 D0 DD 60 25
Bytes 176 - 191 73 16 BB 40 3F A4 5C 4F E2 75 B1 6E 39 F8 6E 05
Bytes 192 - 194 00 00 00
Bytes 195-198 FeC #1 Little Endian
Bytes 199-202 FeC #2 Little Endian
Bytes 203-206 Fec #3 Little Endian
Bytes 207-210 Fec #4 Little Endian
Bytes 211-214 FeC #5 Little Endian
Bytes 215 -226 01 00 00 00 03 00 00 00 FF 00 00 00

[jvkk]

Bytes 00-03 01 00 00 00 # 1 FeC collections
Bytes 04-07 B7 00 00 00 # Size of following contents (i.e. B7 = 183, 183 + 8 = 191)
Bytes 08-13 11 07 FF FF FF FF
Bytes 14-19 03 61 69 DE D4 A7 # 03 + VCRN (I have no idea what 03 means)
Bytes 20-37 VIN + 00 (18 bytes)
Bytes 38-42 56 4F 19 4F Epoch time
Byte 42: 05 #Number of FeCs
Bytes 43-46 FeC #1 Big Endian
Bytes 47-50 FeC #2 Big Endian
Bytes 51-54 Fec #3 Big Endian
Bytes 55-58 Fec #4 Big Endian
Bytes 59-62 FeC #5 Big Endian
# Bytes 63 ~ 190 were signature for identification. 128 bytes
Bytes 63-79 85 18 6F 42 EA D4 9B CD B1 D8 4F E3 F0 64 7E 13
Bytes 80 - 95 A3 84 37 24 B3 05 34 67 DD 05 DB A5 DC 18 97 5B
Bytes 96 - 111 A3 F5 C9 74 29 4D 55 23 E4 85 8D B0 81 AB CB 9D
Bytes 112 -127 AC 95 39 6F 46 39 7A E5 00 88 E3 7B 24 C9 69 D5
Bytes 128 - 143 30 8B BD D2 9A A8 05 A4 01 A2 09 6F 92 30 87 69
Bytes 144- 159 0B 59 F0 44 33 6C B2 8E 99 20 3B 8E 4B FE F7 EC
Bytes 160 - 175 B3 6C 7B 3D 79 DA B7 FE 9A ED 97 B0 D0 DD 60 25
Bytes 176 - 190 73 16 BB 40 3F A4 5C 4F E2 75 B1 6E 39 F8 6E
Bytes 191 - 194 05 00 00 00 # Counts of FeC
Bytes 195-198 FeC #1 Little Endian
Bytes 199-202 FeC #2 Little Endian
Bytes 203-206 Fec #3 Little Endian
Bytes 207-210 Fec #4 Little Endian
Bytes 211-214 FeC #5 Little Endian
Bytes 215 -226 01 00 00 00 03 00 00 00 FF 00 00 00 # These are identify flags

It is almost not possible to produce an valid FecContainer.fec until you have the private key.
or I think you can replace the public key inside MU with one related to your own private key.
This may make some sense, but would be less convenient for later update.

[spyderboyant]

Makes sense.

[spyderboyant]

Also, I have seen another FecContainer.fec that has had Audi Smartphone Interface (ASI) upgrdaded via SVM and the container then gets TWO additional FeCs appended to it (one for each Apple carplay 00060800 and Android Auto 00060900. Only little endian I can find for the additional keys..

[spyderboyant]

You still need US firmware? I have an update for US. Ordered by mistake LOL

[sergey307]

You still need US firmware? I have an update for US. Ordered by mistake LOL

Hi,
could you clarify which firmware do you have, what version for what car?
Thanks!

[moguyun]

Do ypu know the password

[Henno]

Hi all,

anyone can tell me how to mount /usr/ rw ?
Tried
mount -uw /usr/ but is not working for this dir/mountpoint

Also, where dose the root dir come from? There is no mounpoint for /
not in fstab and also df dosnt show any mount for root dir

[Gabi10]

Hi all! I have an Audi A6 2015 with MIB2. On my MyAudi account, the maps available for update are 2017-2018. A friend with A6 2017 has maps 2018-2019 available. I'm trying to get the maps from him but it did not work. Can someone help me to update the maps with 2018-2019. I have the SD card with 2018-2019 maps!

[Gabi10]

My sotware version is MHI2_ER_AU57x_K2570....is it true that if I upgrade the software to a higher version, will I be able to update it to newer maps?

[Tschako]

No, your K2570 is the latest for your pre Facelift Main Unit... You can install newest Maps... But you need an activation of it.
For this, you have to look for people, which can do this in your country...

[agr]

Bytes 00-03 01 00 00 00 # 1 FeC collections
........

Bytes 14-19 03 61 69 DE D4 A7 # 03 + VCRN (I have no idea what 03 means)
.........



What means VCRN?

[Absetup]

chinies ppl are doing a mibroot patch , i think they bypass signatures . anyone has info about this?

[agr]

chinies ppl are doing a mibroot patch , i think they bypass signatures . anyone has info about this?
I think problem here will - how to replace mibroot... it belong readonly fs

[bsvif]

You are great men! This help me for CRC error!

Maybe use solution on VW site for POI update:
Metainfo2.txt:
################################################## ###############################
#
# This is the description file for the Software Update of Volkswagen components
#
################################################## ###############################

[common]
skipSaveTrainName = "true"
vendor = "ESO"
skipCheckSignatureAndVariant = "true"
region = "Europe"
region2 = "RoW"
region3 = "USA"
variant = "FM?-H-*-*-*"
release = "2012/2013"
UserSWDL = "true"
skipMetaCRC = "true"
MetafileChecksum = "3eae301545686f06bcf04e896a1e98e1f1340458"
skipFileCopyCrc = "true"
[PersonalPOI]
VendorInfo = "ESO"
DeviceDescription = "Personal POI Packages"
ConfigComponent = "PersonalPOI"
PacketName = "Package"
ConfigCheckPath = "PersonalPOI/Package/0/default"
ConfigFinalizePath = "/net/mmx/mnt/navdb/PersonalPOI/Package"
IncludeModules = ",Package,"
[PersonalPOI\Package\0\default\Dir]
CheckSumSize = "524288"
CheckSum = "51f3f6ea627c19fb640d1bcdfb7f3787c325dc3c"
FileSize = "198486"
CheckType = "CheckReadData"
DeleteDestinationDirBeforeCopy = "true"
Version = "1"
UpdateOnlyExisting = "false"
IsDestinationInFFS = "false"
Source = ""
Destination = "/net/mmx/mnt/navdb/PersonalPOI/Package"
DisplayName = "Personal POIs"
[PersonalPOI\InfoFile\0\default\File]
CheckSumSize = "524288"
CheckSum = "1abf1ee7e070c8faf74e774f0991733f0d59835a"
FileSize = "640"
Version = "3"
Source = "Update.txt"
Destination = "/net/mmx/mnt/navdb/PersonalPOI/Update.txt"
DisplayName = "Database Information"
DeleteDestinationDirBeforeCopy = "true"
UpdateOnlyExisting = "false"