mattcabb / mib2std-toolbox Goto Github PK

Trying to hack VW Discover Media / Composition Media MIB2 infotainment

mib2 volkswagen seat skoda discover

mib2std-toolbox's Introduction

ℹ️ Don't bother to install it. It's not ready yet.
👍 But somebody else have made something that already works! Check this: https://github.com/olli991/mib2std-toolbox

MIB2Std-toolbox

Attempt to access VW, Seat, Skoda MIB2Std Infotainment filesystem to run some scripts and customize few things.

Supported devices (soon to be)

VW Discover Media MIB2 Technisat

Unsuported devices

VW Discover Media MIB2 Delphi
all MIB1 infotainment units
all Skoda Infotainment units
all Seat Infotainemnt units
all Audi Infotainment units
VW Composition Media MIB2 (no navi, no Personal POI, no attack vector)
VW Discover Pro MIB2 (go to https://github.com/jilleb/mib2-toolbox for a great tool)

Risks

Loosing warranty
Messing up the system
Bricking the headunit
Makine the car inoperable
🔥🔥🔥

Requirements

Supported infotainment unit
Enabled developer mode
Empty, FAT32 formatted SD card

MIB2Std-toolbox Installation

Download the repository.
Place content of the CopyToSdCard direcotry in root directory of the SD card.
Turn the ignition on.
Wait about 1 minute for the infotainment to fully boot up.
Insert card to the SD1 port in the glovebox.
Wait for SD card 1: Software update notification.
Go to NAV > Setup > Manage Memory > Update my POIs > Update > Next.
Wait for Software update complete notification and press OK.
Reboot the infotainment unit by pressing and holding volume control knob for about 10 seconds.
Wait about 1 minute for the infotainment to fully boot up.
Press and hold MENU button for 10 seconds unit the Testmode menue appears.
Go to Green Engeneering Menu > mib2std-toolbox.

Known issues

Well, it doesn't work yet!

TODO

Preatty much everything right now...
VW Composition Media MIB2 - one could use radiostation logo DB update vector.
Dumping interesing files to SD card
Filesystem root password hash extraction
Replacing system UI elements
Replacing system SFX

How it works

Infotainment unit recognizes content of the SD card as Personal-POI update.
./metainfo2.txt file contains list of Variants that the update applyies to and paths for files specific for each variant (for example ./PersonalPOI/MIB2TSD).
Next ./PersonalPOI/MIB2DE/metainfo2.txt file is processed. Again, it contains list of variants but also files & directories to copy, destination paths, checksums, etc. Altering destination path will force custom GEM .esd file to be copied to the infotainment file system.
mib2std-toolbox.esd file is an additional green engeneering menu screen which gives you access to running custom scripts.

mib2std-toolbox's People

Contributors

Stargazers

Watchers

Forkers

bingfeng-ed onemiless koala106 mopi1402 yox2019 achupus wlrnet tehfalcon-vw rick858263 jbasu2013 pixma234

mib2std-toolbox's Issues

Is this project not going on? What a pity

MIB2STD Toolbox for Technisat Nav units now available!

Hey there. I managed to get a working backdoor and developed, together with the MIB2 High Toolbox guys, a toolbox for standard units and we even ported some scripts to std units already.

Skin and startupscreen changes are already possible.

Head over to my repo if you want to check it out. Also many thanks to @yox2019 who helped developing all this!
I'm glad if you want to also contribute to it :-)

https://github.com/olli991/mib2std-toolbox

Merge with MIB2-high toolbox?

Hello :-)
Great work, looking forward to this toolbox!!

Maybe we can merge our toolboxes, so we can have shared things like scripts/tweaks and such. It's possible to support multiple platforms with a single POI update distribution, like this:

|   metainfo2.txt
|
\---personalpoi
    +---MIB2DE
    |       metainfo2.txt
    |
    +---mib2high
    |   |   metainfo2.txt
    |   |
    |   \---personalpoi
    |       +---infofile
    |       |   \---0
    |       |       \---default
    |       |               Update.txt
    |       |
    |       \---package
    |           \---0
    |               \---default
    |                   |   bitmaps.xml
    |                   |   categories.pc
    |                   |   hashes.txt
    |                   |   lang_map.xml
    |                   |   poidata.db
    |                   |   strings_de-DE.xml
    |                   |   versions.xml
    |                   |
    |                   \---bitmaps
    |                           000_image.png
    |                           001_image.png
    |
    \---mib2tsd
        |   metainfo2.txt
        |
        \---personalpoi
            +---InfoFile
            |   \---1
            |       \---default
            |               Update.txt
            |
            \---ppoidb
                \---1
                    \---default
                        |   hashes.txt
                        |   poidata.db3
                        |
                        \---icon
                                000_image.png
                                001_image.png

with metainfo like this:

#################################################################################
#   
# This is the description file for the Software Update of Volkswagen components
#
#################################################################################

[common]
Vendor = "Volkswagen"
Variant = "FM?-H-*-*-*"
Variant2 = "17206"
Variant3 = "17207"
Variant4 = "37206"
Variant5 = "37207"
Variant6 = "47203"
Variant7 = "47204"
Variant8 = "17216"
Variant9 = "17217"
Variant10 = "37212"
Variant11 = "37213"
Variant12 = "47208"
Variant13 = "47209"
Variant14 = "17212"
Variant15 = "37208"
Variant16 = "47205"
Variant17 = "17222"
Variant18 = "47210"
Variant19 = "17210"
Variant20 = "17220"
Variant21 = "17245"
Variant22 = "17246"
Region = "Europe"
Region2 = "RoW"
Region3 = "USA"
MetafileChecksum = "232d798444ca274875adedd35900893b7a40c9e5"

[common_Release_1]
Name = "MIB 2 High Personal POI"
Path = "./PersonalPOI/MIB2HIGH"
Variant = "FM?-H-*-*-*"
Region = "Europe"
Region2 = "RoW"
Region3 = "USA"

[common_Release_2]
Name = "MIB 2 Standard Delphi Personal POI"
Path = "./PersonalPOI/MIB2DE"
Variant = "17245"
Variant2 = "17246"
Region = "Europe"
Region2 = "RoW"
Region3 = "USA"

[common_Release_3]
Name = "MIB 2 Standard TechniSat Personal POI"
Path = "./PersonalPOI/MIB2TSD"
Variant = "17206"
Variant2 = "17207"
Variant3 = "37206"
Variant4 = "37207"
Variant5 = "47203"
Variant6 = "47204"
Variant7 = "17216"
Variant8 = "17217"
Variant9 = "37212"
Variant10 = "37213"
Variant11 = "47208"
Variant12 = "47209"
Variant13 = "17212"
Variant14 = "37208"
Variant15 = "47205"
Variant16 = "17222"
Variant17 = "47210"
Variant18 = "17210"
Variant19 = "17220"
Region = "Europe"
Region2 = "RoW"
Region3 = "USA"

[Signature]
signature1 = "a7bb1ea31cb4da113c0f0bd0babbc453"
signature2 = "0c2b0b4458fbd1f21170f628a497bf16"
signature3 = "d9b0f37aa7fef5ef831cc979880aecff"
signature4 = "3d34c739cb000899483e35e8a0f15dba"
signature5 = "f0a9f4755a11f8d2ad40f20f73b2b0f8"
signature6 = "c0da8da8b39caad53ca0cbb9c2728688"
signature7 = "ec0580833f887f16e5f80ebb6dfa8bba"
signature8 = "0190b4953a7cfc91d4efc2b017f6e20a"

Hi there,
I am currently retrofitting auxiliary heating in my Seat Leon 5F and I noticed that the images in the menu for it are missing so it looks like this:

It is a MIB2Std (part number 5QA035858A) and so far I could not find any way to add the missing image. Would it be possible to do this with your toolkit once it is finished or is there already a way to do it?

Add support to dump the shadow file

Have you already had success reading the shadow file?

I am currently trying to access the MIB via Telnet. I can connect, but I don't have the root password.

Unfortunately I can't contact you anywhere. If you are interested in exchanging information I would be happy if you send me an email to jannik.uhlmann(at)icloud.com.

I am currently working on reverse engineering the FEC/SWaP system of Technisat.

New mib2-toolbox install method will also work on mib2std!

Hello,
we've just developed a new install method for the mib2 high toolbox. This isn't using the POI import anmore.
It uses a donor navupdate so far and build some own modules for the update. For non nav units modified firmwareupdate should theoretically also be possible. ... just realised there won't be a navupdate for std units. So modified firmwareupdate it will be and should be possible.

ESD file is copied like that. We also managed to get a finalScript running within the updateprocess which is copying all the scripts to the unit ans also correctly chmods them.

I sadly have no access to a std unit but if someone can get me a full dump of a std unit I could build an installer for std units too.

We only need the path of ESD menus and also a path were to store scripts on the unit which is accesable for ESD menu.

Just let me know if I should / can assist you @mattcabb

Progress

Any update on getting this working on mib2 technisat?

Is this a tool for the pq platform?

Look forward to using it soon.