Hello, has anyone tryied to use an HD2 with app inventor?? If so, what is the procedure? When i am trying to connect my phone with the blocks editor, the java enviroment cannot see any device. HTC sync is setup and recognised as Dream. Also ADB drivers are setup, but when i am going from app inventor to block editor, a message appears and says "Please locate the adb command on your computer and enter the full path here". I am typing the path of the app inventor on my computer "C:\Program Files (x86)\Android\appinventor-extras" and then the java enviroment continues. I am running 7 64bit.
arisgardelis said:
Hello, has anyone tryied to use an HD2 with app inventor?? If so, what is the procedure? When i am trying to connect my phone with the blocks editor, the java enviroment cannot see any device. HTC sync is setup and recognised as Dream. Also ADB drivers are setup, but when i am going from app inventor to block editor, a message appears and says "Please locate the adb command on your computer and enter the full path here". I am typing the path of the app inventor on my computer "C:\Program Files (x86)\Android\appinventor-extras" and then the java enviroment continues. I am running 7 64bit.
Click to expand...
Click to collapse
Make sure you are not mounting your sd card
Sorry, i am a newbie to the android platform. After some search i found that i need the android sdk.. After installation, the message dissapeared but the blocks editor cannot still find my phone. Has anyone actually used an HD2 with app inventor?
arisgardelis said:
Sorry, i am a newbie to the android platform. After some search i found that i need the android sdk.. After installation, the message dissapeared but the blocks editor cannot still find my phone. Has anyone actually used an HD2 with app inventor?
Click to expand...
Click to collapse
yes, mine works fine.
Ryan Cordero said:
yes, mine works fine.
Click to expand...
Click to collapse
Can you please share some details? for example what programs/drivers/sdk needs the app inventor? installing procedure if its not a trouble for you, what rom are you using and in which mode you put your phone when you connect it with the usb cable, so the blocks editor can recognise the hd2?
thanks in advance.
arisgardelis said:
Can you please share some details? for example what programs/drivers/sdk needs the app inventor? installing procedure if its not a trouble for you, what rom are you using and in which mode you put your phone when you connect it with the usb cable, so the blocks editor can recognise the hd2?
thanks in advance.
Click to expand...
Click to collapse
chuckydroid rom with Hyperdroid and Bangsters Build work. I have to use I.E. because firefox will not work for me. I simply turn the phone on, no special modes or anything and hit connect while the screen is on.. I installed that software they ask you to install before you start, nothing more.
I am having the same problems as described above really but using firefox and linux (ubuntu). No joy getting the app inventor to work witha desire based rom. I am going to try using Chrome to see if that makes any difference and its just a firefox based issue.
arisgardelis said:
Hello, has anyone tryied to use an HD2 with app inventor?? If so, what is the procedure? When i am trying to connect my phone with the blocks editor, the java enviroment cannot see any device. HTC sync is setup and recognised as Dream. Also ADB drivers are setup, but when i am going from app inventor to block editor, a message appears and says "Please locate the adb command on your computer and enter the full path here". I am typing the path of the app inventor on my computer "C:\Program Files (x86)\Android\appinventor-extras" and then the java enviroment continues. I am running 7 64bit.
Click to expand...
Click to collapse
The only problem you're suffering right now is that the path has to look like this
C:\Program Files (x86)\Android\appinventor-extras\adb.exe
You have to write the full path including this file
Have fun. It's a great programm and makes a lot of fun
Edit: There's a how to on the page to set up this path again.
i had to update my version of java to java 6.23,also appinventor works better with chrome browser,surprise,surprise google software talking to google phone through google browser to googles servers...
I'm trying the App Inventor, and I can run things I'm tinkering with. I did one of the tutorials, but when I run it on my HD2, with AmericanAndroid, it is too small.
The app has black blank space on both side, and the bottom. It is probably a little more than half the screen.
I think it is the Android device driver. (But, I'm not sure.)
So, I followed some instructions to download drivers for my device, but the HD2 (on HTC's web page) doesn't have Android drivers. So, I probably need to download them for another HTC device (or something?). Any suggestions?
Or, am I going in the wrong direction, and need to do something else entirely.
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
UPDATE: 04/19/2015 -
While it is not a software hack, IT IS possible to unlock the navigation only portion of the MFT 8", if you have it without nav.
IF YOU DO THIS, YOUR CAR WARRANTY IS VOID. You've been warned.
It will cost a little money, but not set you back $1000 like nav tv and lockpick are charging. Maybe $100 or so.
Here is what you need to do, if you can't wait for us to unlock the bootloader.....
1 - Get a used APIM only part with the numbers DS7T in it. (aluminum only part with the fins, you DO NOT need the screen)
2 - Get the VIN# of the car it came out of and check the VIN to see if it was enabled with factory NAV. There are internet sites that will check the VIN for you. Must be a unit with NAV enabled.
http://researchmaniacs.com/VIN-Number-Lookup/WindowSticker/Ford.html
3. Install the APIM only to the back of your LCD.
4. The system will reboot and reset.
5. The system will them ask you to insert the NAV sd card, do that. (obviously, you have to buy a nav card from ebay as well, but those are $10)
6. Enjoy factory NAV for about $100
This is the only workaround for now. THE APIM is separate from the sync system and only interfaces with it. So, you will retain all your OEM VIN# locked stuff and it will survive reboots and updates. The nac actually just unlocks on that APIM portion, believe it or not. This method doesn't tie into the file system software, it merely accesses it.
Now.... if someone would be so kind as to just rip the NAND chip from one of those units and post it, so that we can just flash over our existing equipment, we can do this for FREE!!!!!!
Still working on the video bypass.... It would be nice if our Russian friends can start chiming in for that one please.....
DON"T FALL FOR THE EBAY GUY CHARGING $600 to $700 for this. Let's put him out of business.... Your help is needed.
PROPS TO rahrena8690 for the find.
WORKING FILE LINKS - FOR DEVELOPERS ONLY
Delayed Reboot project
https://mega.co.nz/#!m0BEWSrA!qrdgIRYTvccH52794ktdpRfrulI_pSdY3g-iiCyhaFs
awesome work
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
I have been wanting to get into this system since the day I got my truck. All ford has succeeded in doing is piss me off with "updates" that didn't amount to much. I would be happy if they would at least allow applink on the touch systems, as that would at least give us some options to add our own work.
I would love to help, but don't have much experience with "rooting", Windows CE, etc. But looking at what you have so far, I will offer some thoughts that came to mind:
It seems to me that you are working at the bootloader level, not the OS level. I may be way off here, but this could be why cmd won't work, as the OS is not loaded, so a traditional shell is not yet possible.
If you are indeed at the OS level, I wonder since you didn't get any errors when trying to launch cmd, if it was indeed actually running. I know on windows systems, if you manage to launch a process as "system", you typically can't interact with it (security issue). I don't know CE at all, but wonder if PsExec would work if it is launching your exe, but as system...
If it is executing your exe as system, perhaps a script or small app that writes some info about the system to a file on the usb drive would help. IE, have it list the folder structure for example.
I know we are not alone on people wanting to work on this. It looks to me that with Sync 3 dumping MSFT, we may be left in the dust with no further updates, although, this guy has found some signs that it might still get some useful updates:
http://www.reddit.com/r/Ford/comments/2rf2cc/ford_may_announce_updates_to_sync_gen2_myford/
Thanks
kthejoker20 said:
Ok Devs-
(ALSO sync owners, don't update your sync systems anymore by ford, we are getting close to unlock it, and they will put out updates to bork our hack).
I need some help please. I need to modify this POS sync. You can't do anything with it. I want to get navigation running or bluestacks to run android.
I got the official ford , usb reboot file I have attached it here. It has the signed files that we need.
I was able to tigger the install event with those files. And I believe this is our key to Jailbreak the system.
The best part is that you can run stacked commands on those install scripts. https://www.coalfire.com/The-Coalfire-Blog/October-2014-(1)/Reverse-Shells-and-Your-Car?feed=blogs
I have been struggling to get it it to execute, presumably, I don't know anything about win CE.
I have the win CE cmd.exe on my usb. Place it into the system, it recognizes and initiates upload. What the code below is trying to do is piggy back on the copy via stacked code to upload cmd.exe to the system then execute it. UNless there is another way to get a shell, once we get the shell, WE OWN THEM.
This is what my path is listed on my autoinstall.1st file -
Open1 = DelayedReboot.cab; cmd.exe \tmp\cmd.exe; \tmp\cmd.exe
the cab is required as it is signed by microsoft and bypasses the lock to load additional code.
Changing the semi colon to & makes it error out, so the semi colon is correct, just dunno if I have the paths right. Normally, it would be something like for linux /fs/usb0/etc...... but I am not sure about CE lists the usb device path...again I am win CE retarded. UNless there is a way to % to the paths, but I dunno much about win.
Sync, recognizes and executes with no errors. If I change my code a little, it will not work and say error.
SO what am I missing to get the cmd to run? Or is it already? I was expecting a shell to pop up?
If someone can point me in the right direction, or to point what file I can call to execute the onboard navigation, that would be awesome as well.
Even if we can't get a shell, I'd like to be able to execute a file, then I can run MIOpocket on this thing and ditch sync for android apps.
I have also attached the sync app developer guide link. With programming commands for apps.
https://developer.ford.com/uploads/DevConf%20-%20Track%205%20-%20Best%20Practices.pdf
Here is a link to the windows 7 automotive guide on how the system operates, kernel info, driver info, and stuff.
http://download.microsoft.com/download/0/A/1/0A1E07D6-7562-4566-AACF-E04DF4FF8879/A%20Technical%20Companion%20to%20Windows%20Embedded%20Automotive%207%20(final).pdf
Click to expand...
Click to collapse
Thanks Pro. any new updates. Actually i just purchase Lincoln MKZ 2014, although i know it is hardware capable to run navigation since i get latitude and longitude, but unfortunately no navigation from the factory. i just play with My Lincoln Touch and on the sittings there is a tab for installing apps. so can we install and windows CE app?
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
kthejoker20 said:
Nothing yet.
Sync updates are rolled out every 6 months.
Rumor was that we are all getting blackberry upgrade from Microsoft.
Update is expected Feb 2015 or so.
We are sitting on the sidelines waiting to see what Ford will do, before we start porting over. There may be no need for our work if we get port link to the new system. I think Ford is on our side, as they don't want us open sourcing the system and have to deal with warranty claims.
Click to expand...
Click to collapse
i don't think so. we will not get the QNX update. I think it is a different system with different architecture and requirements. but i hope they unlock the FMT or LMT so we can install any windows ce app.
Please don't reply to this thread with comments or requests.
I'd like to keep it clean to only development comments.
Based on what I'm reading around the page 26 mark (bootloaders section of the windows embedded 7 pdf), it sounds like we need to attempt to give the IPL boot arguments to get into update or development mode and from there we could have a chance of pushing our own files. I would think update mode looks for a signature but dev mode might let anything in.
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
kthejoker20 said:
Way ahead if you. The attached file has the signature. I was able to successfully run stacked commands by modifying the attached reboot file. Problem, the command doesn't stick on reboot.
Click to expand...
Click to collapse
So you were able to launch a command prompt via the delayed reboot zip? I wonder if it would be possible to hack a sync update and then use this to push it.
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
kthejoker20 said:
I need a zip please... I can induce an update no command prompt yet
I can only run commands stacked, but I need to run a script on the sync side, but I can't figure out how to push the script to the sync
Click to expand...
Click to collapse
This the latest myford touch update Gen2-V3.7.11
http://www.mediafire.com/?79v3d0d8972sy44
Here is the Delayed Reboot zip
http://outofmytouch.com/assets/delayed_reboot.zip
So some very quick looking tonight and I found EA5T-14D546-ATD contains the master patch. Decompiling some of the shockwave files I have found some interesting code. These would most likely be the files to hack to change factory behavior. Getting them flashed to a vehicle might be a whole other issue though.
Edit: After more browsing I think we need to target a master patch for an older version of Sync. I was looking at the master patch for the most current so there are going to be less files patched. I will have a peek at those later.
For some reason, the coalfire site took down it's information regarding the reverse shell of the infotainment system.
Here is what I am talking about with the command on the delayed reboot file. I have conveniently located the stacked command image and attached it for your viewing pleasure.
If we can patch the files, this is how we push them to the chip. Otherwise, I may have to PHYSICALLY pull the system files through JTAG tap... sigh... not really wanting to do that though...
If we can push them, we would have to unlock the bootloader to bypass the sigs... This is where my brain is staring to hurt....
Obviously, these commands do not apply to what we are doing, as that is QNX. Plus, I don't want any noobs spunking their system with our fashizzle yet...until we test it.
Just a final thought, as a plan B, we could reverse shell with the USB exploit as well... just saying.. might be easier
An integer overflow might work as well, but I have never experiemented on an embedded chip. Stacked command invoking an integer overflow, might give us write access to the system.
Has any thought gone into rewriting one of the dll's included in the latest patch to include some sort of backdoor? It seems it'd be easy (maybe I'm missing something here) to just modify the latest patch's install files to install our new dll.
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
kthejoker20 said:
I haven't had time yet, but I am going to try to USB otg pull.... I'm sure I can probably at least disable the vss lock.
Click to expand...
Click to collapse
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
Click to expand...
Click to collapse
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Looking forward to following the progress of this thread! I hope that you all will discover a new solution to our these outdated systems! Good luck guys, I am rooting for you!
duckboy81 said:
When you tried running the cmd prompt with the stacked command approach did get any indications of the program running? I was thinking about adding some arguments to the end of the command to write a random file to the root of an available drive (like you said, who knows how the thumb drive is recognized).
Also, what type of processor does the system run on?
---------- Post added at 11:51 PM ---------- Previous post was at 11:30 PM ----------
I think I answered one of the questions. From the PDF you posted "A Technical Companion..." it's a Freescale IMX35 processor.
freescale.com/webapp/sps/site/taxonomy.jsp?code=IMX35_FAMILY&cof=0&am=0
Click to expand...
Click to collapse
Actually I am pretty sure the MyFord Touch processor is an I.MX51 acccording to a Ford PDF I found. Unfortunately I am new to posting here and it won't let me post links.
I work on the almost identical I.MX53 processor at work doing Linux kernel, u-boot boot loader, and Linux application software, so I might be able to help.
Most of the I.MX processors have built in ROM code that allows booting to a USB or Serial downloaded mode. This allows loading any software you want into any RAM address and then booting from it. Then you run completely out of RAM (like a live CD). Depending on how Ford setup the I.MX51 e-fuse settings, there may be an external pin that could be used to enter this serial downloaded mode. Freescale provides a tool called the MfgTool to load software using the serial download mode. Then you could load Linux, Android, or whatever. The e-fuses also allow you to lock out JTAG, serial downloaded mode, and enable boot time signature checking, but I am not sure if Ford used any of these to lock the system down.
Do we know where the processor is located in the fusion?
I have developed apps for Android and Wear OS watches – mainly for personal use. It's no problem for me to use ADB to Install to a watch.
But, I would like to install the APK on a friend's watch, who is not a developer or very technical. It Would be nice to be able to do this without a lot of rigmarole. I can enable Developers Options on his watch, but installing ADB to his PC is asking a lot. It would be nice to have a PC app, hopefully that is portable and can reside on a flash drive, that will simply interface with the install protocol to install an APK on the watch.
Does something like this exist?
Barry.
A little more searching and I found this, Flakie's ADB GUI:
Direct download:
https://flakie.co.uk/downloads/FlakieADBGUI.zip
There is a GUI for the common ADB commands and an integration with scrcpy (as in version 1)
It now has an experimental option to use ADB and ADB Shell commands by typing/pasting them in.
I have not actually tested it, but it seems to be exactly what I was looking for.
I downloaded ADB and put the "platform tools" folder on my Flash drive. I also put Flakie's on the flash drive along with the APK I intend to eventually install.
Theoretically this should give me a portable install for the APK (fingers crossed). I am hoping to connect to my friends watch via Wi-Fi and use Flakie's to install the APK.
As an alternative, there is also ADB AppControl. It is well known, and the developer has it quite improved.
ADB AppControl
Official website of the ADB AppControl application. Free Download. Latest release. The ultimate applications manager and debloat tool for Android devices.
adbappcontrol.com