librick
Joined 3 years ago
Karma
313
Submissions
12
Member since
May 24
Recent submissions
Comment · 4 months ago
To update 10th-gen Honda Civics, Honda ships updates on specially-formatted USB drives. They're essentially Android 4.2.2rc1-era recovery packages with some Honda-added version checks (which can be spoofed). The packages are signed with the publicly-known AOSP test key, so with physical access to the front USB port you can sign and flash your own package for arbitrary code execution on the headunit. This doesn't require root/su. I've run it end-to-end on my own 2021 Civic and separately confirmed an official EU update file carries the AOSP test-key signature. Tooling and writeup in the post.
Comment · 3 years ago
*Jankiness, not jerkiness. I could have clarified that better; what I mean is that it was strange to me that the backup camera had two stages. The camera video feed comes up first, then the yellow overlay lines are rendered on top later. Which makes sense, that way the user doesn't have to wait for Android to boot up completely before they can view the backup camera.
I want to look more into rear camera viewing/recording too. The binary /sbin/earlyrvc in the repo (in the boot recovery image directory) is what displays the camera on boot. After that there's a few Honda-specific APKs that handle backup camera access for the rest of Android. I had some luck using Ghidra for static analysis of /sbin/earlyrvc. But the biggest hurdle I ran into is a lack of documentation on NVIDIA kernel drivers and the graphics pipeline.
As for rooting, I used a paid ($25) service. You sign up on this sketchy site, pay the $25 to get a unique code (a UUID), and then visit a specific website from the headunit's web browser. AFAIK, whoever runs that service is basically just using a WebKit exploit chained to some other Android exploit(s) to achieve root. It worked for me. I've added some more info on this to the README. But one of my goals is to make rooting easier/free/open source to lower the barrier-to-entry for headunit hacking. It'd be great to see a PR for that
Comment · 3 years ago
TLDR; Kia rant: Yea it's bizarre to me how recalls aren't more widespread. The fiasco with Kia cars getting broken into is my favorite recent example. Teenagers break into random stranger's Kias and go on joyrides. Then local news channels and police sensationalize Kia car break-ins or villify bored teenagers. It seems like very few people actually demand recalls by Kia. A car that can be unlocked in the span of a TikTok video is a dangerous car; it's a public safety issue. I'm mostly ignorant of the recall process, but it seems like they should be more widespread than they are
Comment · 3 years ago
I can't speak to CarPlay but yea I'll say the headunit software is certainly usable. One of the reasons I started this project was because I admire the engineering involved. I wish they would've shipped wireless Android Auto though. My car only works with wired Android Auto. It was only a minor inconvenience until I broke a USB-C cable. I rely on my car, I didn't need a failure point in my navigation. I ended up buying an adapter (the Motorola MA1) that lets me use Android Auto wirelessly (the MA1 worked okay, I had a few issues where it would randomly reboot but one day that stopped and I still don't know why; it's finicky). It just seems absurd to have a whole separate hardware/software stack in the form of an adapter just because Honda couldn't use a newer Wi-Fi/Bluetooth chip
Comment · 3 years ago
Yea I tend to have pretty high memory usage, including when I was running close to stock (i.e., before installing a bunch of third-party apps). My model didn't come with a built-in GPS app, but I was told that the next trim up/more expensive model did. I think more expensive trims came with headunits with more RAM (I think 4GB?) but I can't confirm. It'd be great to see a PR from someone with better hardware to see the actual headunit differences between trims
Comment · 3 years ago
Addressing "(It doesn't have a cellular data connection so it's not a security risk)" - I wouldn't say it's not a security risk. Check out the Bluetooth docs in the repo for example. Cellular data is only one interface out of many others (Bluetooth, Wi-Fi, CAN, XM radio, HD radio). Jailbreaking anything isn't without its risks.
Further, I agree that it's reasonable to ship a 2016 car with 2012 software. But I've seen no evidence that these headunits have gotten security updates within that timeframe. Think of it like a smartphone. I can make do with a phone that's a few years old, but I have an expectation that it will receive timely security updates. In the case of the Honda headunits, they run Android. They should receive Android security patches (I'll admit there's certainly complexity there, Google has long struggled with the tradeoff between device security and AOSP ubiquity). There's nothing wrong with using an older version of Android or an LTS kernel, but it should still receive security patches.
Last year, some Mazda cars were accidentally bricked by a radio station broadcast omitting file extensions: https://arstechnica.com/cars/2022/02/radio-station-snafu-in-.... That was an accident, not the work of a malicious actor.
Consider Stagefright bugs. As I understand it, although it was published in 2015, it affected several earlier Android versions, including 4.2.2. See: https://en.wikipedia.org/wiki/Stagefright_(bug). As far as I know, my car was never patched against Stagefright bugs. All it takes is a bug in one library (such as for HD radio image processing) and a well-published Android for something like this to be a big problem.
It's complicated; I like jailbreaking. I also think Honda should ship higher-quality software with better security policies and update guarantees
Comment · 3 years ago
Yea if I get more into the hardware hacking side of things, it'd be great if I could add a wire harness to be able to connect external power to the headunit/disconnect it from the car battery. I never had to fully disconnect battery terminals or anything but I had some scares with slow reboot times. I also want to look into LoRa or similar wireless tech to be able to send terminal commands to the car from my desk
Comment · 3 years ago
Thanks :) My friends and I have made a few jokes about hacking my literal "daily driver". TLDR; didn't excise, mostly sat in my car.
I originally rooted the car using Honda Hack via http://www.autohack.org/. A paid service that afaik uses a webkit exploit and probably an old Android kernel exploit to gain root. Part of the motivation for this project was to encourage others to release open-source rooting tools so they don't have to shell out the $25 for the "pro" version that I did.
Once I had root, I installed a few apps via a USB drive, including a file manager and a third-party app for ADB over TCP (I don't think 4.2.2 had built-in support for networked ADB). Then I connected my car to a Wi-Fi hotspot on my phone (at one point editing Android's wpa_supplicant.conf file directly because it got corrupted). Once I made sure that the headunit would autostart ADB over TCP and always try to connect to a certain Wi-Fi network, I had a decent safety net.
So I spent a good amount of time sitting in my car with a laptop after that though I was able to pull partitions via dd and do a lot of research sitting at my desk, especially static analysis of APKs, native libs, and binaries, stopping back at my car on occasion to grep gpio pins or sysfs values.
I didn't want to risk pulling the headunit from the car; that was (and is) an emergency fallback in case I ever wipe flash or something and need to reflash to the physical board. Fortunately I never had the need. I'd be great to get detailed pictures of the unit though. A quick eBay search shows headunits going for ~$1,000, which imo is ridiculous given that they're glorified Android tablets c. 2012. But if anyone has an extra they're looking to donate, definitely get in touch
Comment · 3 years ago
The apparent jankiness of the rear camera was one of the first reasons I started hacking on the car tbh. It was weird to me that the yellow guidelines/overlay don't appear on the camera feed until a little while after the camera feed first shows up. I've confirmed that it's a two stage process controlled in part by the /sbin/earlyrvc binary and later accessed via an Android service. But I'm not sure why the Honda devs didn't include rear camera dash cam functionality. Especially because you can use the side camera while driving, but not the rear camera. My working theory is that there's some sort of limitation with frame buffers or processing power but . I definitely encourage other devs to look into this too
Comment · 3 years ago
As far as I currently understand it, most of the code on my headunit is probably 99% identical to the code on 2021 Accord units. Same goes for Acura cars; I can't publish the APK files themselves but there are Acura versions of Honda logos in most of the APKs. Also check out some of the APK filenames: https://github.com/librick/ic1101/blob/main/docs/apk-hashes.....
I welcome PRs/contributions from the community; things like Honda-internal model numbers represent a non-technical obstacle for me as a lone developer. It'd be great to see boot/recovery images for similar vehicles, Accords included.
One of my goals is right-to-repair adjacent. I bought a Honda in the first place because they have a reputation for having an active modding scene and I see value in that positive feedback loop. Hopefully having the repo as a resource helps other people do more hardware mods or manufacture cheaper/consumer-friendly replacement parts.
I've considered trying to make an open source replacement of the /sbin/earlyrvc binary for rear camera hacking specifically. I caught a lucky break because the binary includes logging messages left in by the Honda devs and the messages include method names.
Thanks for the kind words and encouragement :)