0% found this document useful (0 votes)
364 views11 pages

EMMC Backup and Soldering Guide

This document provides instructions for gaining root shell access on a vehicle unit via two methods: 1) desoldering and modifying the EMMC, and 2) updating the firmware to change the challenge public key. It then describes how to convert the region/language settings to European versions by modifying system files and updating firmware. Finally, it lists some other common commands like backing up files, patching SWaP and component protection, installing maps and engdefs files.
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
364 views11 pages

EMMC Backup and Soldering Guide

This document provides instructions for gaining root shell access on a vehicle unit via two methods: 1) desoldering and modifying the EMMC, and 2) updating the firmware to change the challenge public key. It then describes how to convert the region/language settings to European versions by modifying system files and updating firmware. Finally, it lists some other common commands like backing up files, patching SWaP and component protection, installing maps and engdefs files.
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
  • Shell Access via Soldering
  • Shell Access via Challenge
  • Region Conversion
  • Gracenote Installation
  • Backups
  • Patch SWaP and Component Protection
  • Maps
  • Other Commands

1.

Shell access via soldering


Disassembly unit and desolder EMMC. Do a full Backup of EMMC (optionally), but it is always a good idea to have a
full backup.

Open dump file with any HEX Editor and replace values in HEX! (Values will repeat 2 times, you need to change
both.)

Find: 726F6F743A2A3A303A300A6E6F626F64793A2A3A303A300A736C6F673A2A3A30
Replace: 726F6F743A 48 53 69 70 48 42 62 76 68 68 53 72 49 3A 30 3A 30 0A 0A736C6F673A2A3A30
Solder EMMC back to unit.
2. Shell access via challenge method
Update with “Special firmware” which changes public key of challenge. To do that. Hold two fingers in top right
corner to enter SWUP (RED) Mode.

Press + Update
Everything should say N/A except ExceptionList. It is normal, just scroll down and press Start update.

After update finished, press + Resume

NOTE: ALL CHANGES ON UNIT SHOULD BE DONE IN RED MENU !!! HOLD 2 FINGERS IN TOP RIGHT
CORNER, UNIT WILL GO TO RED MENU, ONLY THEN YOU CAN CONTINUE WITH FECS/CONVERSION.

When unit is in red menu, connection to unit can be done via D-Link DUB-E100. You need to change IPv4 address
and mask to same as Harman uses.
Challenge is on telnet [Link].48:22111

Copy CHALLENGE KEY and ask for a RESPONSE (Use generator, or ask somebody who provides you access via
tokens..)

Paste response back to putty and press Enter. Putty should close. Now you have opened telnet access and can
connect with port 23.
MMX console Telnet: [Link]:23
Challenge Telnet: [Link]:22111

Note: If you can’t login, you are probably in normal, not in red menu. Go to red menu, and try to login then.

If you used EMMC method, password for root will be: harman_f, if you used challenge method, there will be no
password, but only for one time! After reboot unit will ask again for a password. To disable password you need to
run these commands: (RUN ALL COMMANDS ONLY FROM RED MENU !!)

mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup


cp /mnt/swup/etc/nopasswd /mnt/swup/etc/passwd
sync

Now, even after reboot, your unit will have no password.


3. Region conversion
Login to unit with telnet [Link]:23 and execute next commands:

touch /mnt/persist_new/swup/skipCheckMetaChecksumPROD
touch /mnt/persist_new/swup/skipCheckVariantPROD
touch /mnt/persist_new/swup/skipCheckInstallerChecksumPROD
touch /mnt/persist_new/swup/checkAllUpdatesPROD
touch /mnt/persist_new/swup/allowUserDefinedUpdate

Reboot unit by long press power button. Extract patched firmware to SD Card.

Press + User Defined > All > Remove selection from AMP* and DUC2H* > Start software update

After update finished, you must perform parametrization with VCP. Go to Can Procedures > Apps > Data Container

Check 5F module and load file: A6_mib_4k0035165b.zdc

In data container check VISIBLE_LANGUAGES_EU or AVAIBLE_LANGUAGES_EU push Load Data. Restart unit, EU
languages list will be present on MENU now.

Go to Coding and change to:


COUNTRY NAVIGATION – EU
BAND SETTINGS FM TUNER – EU_RdW
BAND SETTINGS AM TUNER – EU_RdW
NAVIGATION SYSTEM: enable

Go to Adaptation:

VEHICLE CONFIGURATION: SDS_Region_F: REGION_EU

NOTE: If you don‘t have sound in tuner after conversion, change PI_ignore to active in coding.
Installing gracenote

Put Gracenote2 and RadioStationDB folder to root of SD Card, and execute following commands:

cd / && mount -uw /fs/sdb0

mount -t qnx6 /dev/mnanda0t177.9 /mnt/gracenotedb && mount -uw /mnt/gracenotedb/

cp -Vrf /fs/sdb0/Gracenote2/Database/0/EU/* /mnt/gracenotedb/database && cp -Vrf


/fs/sdb0/Gracenote2/InfoFile/0/EU/[Link] /mnt/gracenotedb/[Link] && cp -Vrf
/fs/sdb0/Gracenote2/Version/0/EU/[Link] /mnt/gracenotedb/config/[Link] && umount
/mnt/gracenotedb

mount -uw /mnt/misc1 && cp -Vrf /fs/sdb0/RadioStationDB/VW_STL_DB.sqlite


/mnt/misc1/rsdb/VW_STL_DB.sqlite

4. Do a backup before modifying or patching any files!


mount -uw /fs/sdb0/
cat /dev/fs0 > /fs/sdb0/fs0_mib2p
cat /eso/bin/apps/fecmanager > /fs/sdb0/fecmanager
cat /eso/bin/apps/componentprotection > /fs/sdb0/componentprotection

mkdir /fs/sdb0/fec_backup/
cp -f /mnt/persist_new/fec/* /fs/sdb0/fec_backup/
5. Patch SWaP and Component Protection
Put patched fecmanager according to the version and [Link] to root of SD Card. Enter to red menu, login
with telnet to [Link]:23 console and execute following commands to replace fecmanager:

mount -uw /fs/sdb0/


mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
cp /fs/sdb0/fecmanager /mnt/app/eso/bin/apps/
chmod 777 /mnt/app/eso/bin/apps/fecmanager
mount -t qnx6 /dev/mnanda0t177.2 /mnt/swup
cp /fs/sdb0/fecmanager /mnt/swup/eso/bin/apps/
chmod 777 /mnt/swup/eso/bin/apps/fecmanager

And these to change [Link]:

mount -uw /fs/sdb0/


rm /mnt/persist_new/fec/*
cp /fs/sdb0/[Link] /mnt/persist_new/fec
chmod 777 /mnt/persist_new/fec/[Link]

Optionally you can also do CP-OFF. Put patched componentprotection file on SD and replace with
following commands:
mount -uw /fs/sdb0/
cp /fs/sdb0/componentprotection /eso/bin/apps/componentprotection
chmod 777 fecmanager
6. Maps
Latest maps can be downloaded from [Link]

Write navigation data to root of SD Card. Boot into normal mode,


insert SD, and start update.
7. Other commands:
Emergency mode:

echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-emr-reset >
/dev/ooc/system

SWUP mode (RED MENU):

echo active > /dev/rmgr/swup && echo swup-start > /dev/ooc/system && echo swup-reset > /dev/ooc/system

touch /mnt/persist_new/swup/developmentflag
mount -uw /mnt/system && touch /mnt/system/etc/startup_test_mode && mount -ur /mnt/system

Copying engdefs (GREEN MENU) from unit to SD:

mount -uw /fs/sdb0/


mkdir /fs/sdb0/engdefs_backup/
cp -r /mnt/app/eso/hmi/engdefs/* /fs/sdb0/engdefs_backup

Installing engdefs (GREEN MENU) from SD to unit:

mount -uw /fs/sdb0/


mount -t qnx6 /dev/mnanda0t177.1 /mnt/app
cp -r /fs/sdb0/engdefs /mnt/app/eso/hmi/engdefs/

Common questions

Powered by AI

Before performing any modifications or installations, creating a backup is crucial to ensure recovery if the updates fail or corrupt the system. This involves altering the mount settings to writable and copying important data (like '/dev/fs0', 'fecmanager', and 'componentprotection') to the SD card to have a fallback if restoration is needed . Such precautions help maintain data integrity and system functionality, effectively preventing irreparable data loss and system damage .

Updating navigation maps involves downloading maps from an authorized source and transferring the data to the SD card's root. The unit must then boot into normal mode, insert the SD, and initiate the update process . Performing these actions in normal mode is necessary as it ensures updates are applied within the operational framework that maintains full compatibility and functionality standards required for navigation. Normal mode offers the active environment needed for the system to correctly interpret and integrate new data without the risk of mismatches that could occur in more permissive update modes like SWUP .

Executing all commands from the red menu during SWUP mode modifications is essential because the red menu represents a special maintenance mode that allows updates with less restricted permissions and direct access to system files. Commands executed outside this mode might not have the required permissions or might not correctly trigger the necessary system configurations, leading to incomplete updates or unsuccessful modifications . The red menu ensures that updates bypass typical validation processes, providing a controlled environment to implement critical changes without user locking or integrity checks normally enforced in regular modes .

Region conversion impacts the unit by enabling region-specific functionalities such as language settings and tuner configurations. After conversion, languages available within the unit's menu are localized for EU regions, which can be facilitated by changing coding settings like COUNTRY NAVIGATION, BAND SETTINGS for both FM and AM Tuners, alongside enabling the NAVIGATION SYSTEM for the EU . Additionally, adaptations are made to the vehicle configuration to align with REGION_EU settings, ensuring the unit supports EU-specific features .

Installing Gracenote requires specific environmental setup, including preparing an SD card with the necessary Gracenote and RadioStationDB files placed at its root. Accurate execution of commands to mount file systems as writable and copy specific configuration files to predefined directories is crucial for ensuring that Gracenote operates correctly . Any deviation in the prescribed commands can result in failure to correctly update databases or incorrect application of Gracenote updates, leading potentially to missing metadata, incorrect radio station information, or failed new feature integrations .

If PI_ignore is not activated after region conversion and tuner sound issues arise, the unit might fail to correctly process radio signals under the new EU setting. The PI_ignore setting is crucial as it adjusts signal processing irrespective of geographical discrepancies, thus enabling uninterrupted sound reception across various frequencies post conversion . Failure to activate this setting could lead to persistent issues with sound quality or complete loss of tuner audio, undermining the purpose of the conversion .

To permanently disable the password requirement after using the challenge method, all commands must be executed from within the red menu. You mount the filesystem, copy the 'nopasswd' file over to 'passwd', and commit the changes so that even after a reboot, the unit will no longer prompt for a password .

Emergency mode and SWUP mode are distinguished by their functions and initiations. Emergency mode is typically used for immediate response to catastrophic system failures where quick resets and minimum viable operation are needed to prevent further damage or to recover the system to a known safe state . SWUP mode, however, serves the purpose of applying software updates and modifications under controlled conditions that relax normal operating constraints like security checks . Each mode is triggered through specific command sequences, and choosing between them depends on whether the intent is stabilization (emergency) or modification/updating (SWUP).

Modifying the EMMC involves directly editing the firmware via HEX value replacement, which can grant root access by changing specific values in the EMMC and requires a physical interaction such as soldering . The challenge method, however, involves updating with special firmware that alters the public key requirement, necessitating a two-finger tap to enter the SWUP mode and allowing telnet shell access without a password, but only once . Both methods provide shell access, but the EMMC method can provide more permanent access whereas the challenge method may require repeated entry after each reboot unless additional steps are taken to disable the password requirement .

The developmentflag and startup_test_mode play critical roles in configuring the system for updates and testing. Enabling the developmentflag in SWUP mode indicates to the system that developer-mode updates are permissible, which might include unsigned or less stable updates that aren't subject to standard user mode constraints . Similarly, the startup_test_mode allows for boot sequences where testing and diagnostic checks can proceed outside normal operational restrictions, providing a controlled environment for developers to troubleshoot, test updates, or revert configurations without interference from automated stability settings .

1. Shell access via soldering 
Disassembly unit and desolder EMMC. Do a full Backup of EMMC (optionally), but it is always a
 
 
 
 
Solder EMMC back to unit.
2. Shell access via challenge method 
Update with “Special firmware” which changes public key of challenge. To do that. Hold
Everything should say N/A except ExceptionList. It is normal, just scroll down and press Start update. 
 
 
After update fini
Challenge is on telnet 172.16.250.2.48:22111 
 
Copy CHALLENGE KEY and ask for a RESPONSE (Use generator, or ask somebody who
MMX console 
Telnet: 172.16.250.248:23 
Challenge 
Telnet: 172.16.250.248:22111 
 
 
 
Note: If you can’t login, you are prob
3. Region conversion 
Login to unit with telnet 172.16.250.248:23 and execute next commands: 
touch /mnt/persist_new/swup/ski
Installing gracenote 
 
Put Gracenote2 and RadioStationDB folder to root of SD Card, and execute following commands: 
cd / &&
5. Patch SWaP and Component Protection 
Put patched fecmanager according to the version and ExceptionList.txt to root of SD C
6. Maps 
Latest maps can be downloaded from https://app-connect.volkswagen.com/mapupdates/en/car/  (https://app-connect.volks

You might also like