Turbo Quattro

Hi,

Thanks for the answer.

I have MHI2_ER_AUG11_P0040 also. I need P0034 because they has languages which are missed from P0040 and I would like to extract the language files from it.
I have an access to a car with P0034 firmware, it's I don't know the password or password hash for it. It has MU ...

Hi,

I'm looking for MIB2 firmware MHI2_ER_AUG11_P0034 firmware.
Maybe someone can share it with me?
(I didn't found it on Service42-MMI servers...)

Regards,
leader

Hi,

Can somebody tell me what the offset year of MIB2 High EU Navi codes 093000XX?

For example my car is from 09.2016 and the FEC code for the navigation is 09300008. So what will be the expiration date of free Map upgrade?

Regards,
leader

I also found something interesting when I use 'file' to identify content of dumped data...
Is this useful or just no use because it's a public key?
dump/> file HBpersistence/Keys/*/*
HBpersistence/Keys/DataKey/AU_MIB-High_DK_public_signed.bin: data
HBpersistence/Keys/DataKey/BY_MIB-High_DK_public ...

I have one FecContainer.fec from VW's discover pro (MIB2HIGH). I did some basic check... The file size should be 4 + (195 x FeC counts). The first 4 bytes means how much FeCs inside the container.
For each FeCs, Start with 0x000000AB and end with 0x000000FF (little endian)
For each offset of ...

[ATTACH=CONFIG]60800[/ATTACH]

This is the secret key file?

I think it must be an important file. If you check the filename it's "maybe" the container file for FeC codes (like in RMC where FSC are stored in Container too).
If you reverse the fec binary in IDA you can found some FeC related ...

You made it work w/o patch of mibroot or mmi3gapp....?
I’ve tested on metainfo and fec and both don’t work with stock firmware.

No yet.
Have you recallculated the MetainfoChecksum correctly before sign it?
Have you replaced all 4 Metainfo keys in MIB?
What error message do you receive when try to ...

leader писал(а):Have you tried this on FEC keys too?
It seems than is working on Data and Metinfo keys (all are the sames) but not on FEC Keys...
And of course the same logic works on MMI3G family too.

Now I discovered the trick....

FEC files are not self signed. They are signed with Metainfo/Data key...

Read that https://reverseengineering.stackexchange.com/questions/12286/defeat-rsa-hash-verification/12287
And pay attention to my comment at the end :)
Regards.

Have you tried this on FEC keys too?
It seems than is working on Data and Metinfo keys (all are the sames) but not on FEC Keys...
And ...

Hi Zdenek,

Have you found solution for this?
There is a tool to convert ans file to wav and wav to ans?

In mmi3g there is a config wile where supported formats can be enabled. Both ANS and WAV files are supported by MMI3g but would be nice if we can convert ANS...

Thanks, I tested it and worked like a charm

It was more than enought...

Yet I know everything about fsc and public keys in mmi3g, rns850, MIB1 head units...
For mmi3g and rns850 is not to hard to inject own keys and maybe there is one (or maybe two) methods for MIB too...

Everyone knows in what format the public key is stored in the *_public_signed.bin files?

If the signture is 1024 bits (128bytes) than the public modulus must 1024 bits (128 bytes) too. But here the bytes are stored in 288bytes (in mmi3g the 1024bit public keys is stored on 256byte).
I played many ...

Unpackign the ifs image is not a hard work.
With the help of mmi-ifs tool you can dump and decompress teh filesystem image. Than with dumpifs and with some shell scripting knoweledge you can extract and create the directory and file structure including the symlinks.

Maybe somebody can give some ...