How To Resert Rear View Camera On 2015 Mustang Without Navigation
MyFord Affect system hack. Enable features, navigation, rear view camera, etc.
- Thread starter mdl054
- Start date
- #1
https://forum.xda-developers.com/windows-mobile/general/myford-touch-navigation-activation-t3368080
At that place was a thread on this topic a while dorsum and has since been closed. Pending certain developments it has become prudent to open up a new thread to discuss these new directions.
The last thread can be establish here: http://forum.xda-developers.com/windows-mobile/general/hacking-myford-touch-getting-closer-t2938321
First of all, I desire to start this thread by saying this is Not intended to first fights! 1 user, jmr061, has figured it all out and currently charges coin through his own private website and business organisation in the Wisconsin area. I don't want to hear anything almost putting anyone out of business. His business concern is his own. Its fine if you experience that way but this thread isn't the identify to discuss it. He is also the only one thus far who has successfully plumbed the workings of MFT entirely and I have zilch only respect for him. He also happens to be a very helpful poster on many Ford enthusiast websites across the net and doesn't deserve whatsoever chastising of any kind. Continue it clean!
Current option for adding Navigation to MFT in a non-Nav equipped vehicle:
Replacing the APIM with a Nav enabled one. The part numbers are different and a few versions be. To successfully add together the new APIM you lot must friction match the correct options. Past not getting the proper APIM y'all volition very probable lose features such as the fill-in photographic camera, etc.. To properly check which car came with what options you will demand to use Ford Etis. Ford Etis can exist constitute Here. Options that are not enabled past the manufacturing plant bear witness as "Less Thirty" where 30 represents the pick. For example, a car without Nav will read "Less Navigation". Similarly, a auto with Nav will read "With Navigation". Y'all must match all options.
There are a few downsides to this process. Offset of all, the obvious is finding an APIM that is correctly configured for your motorcar. Secondly yous will need to rip the dash apart. It isn't particularly difficult depending on your model but it tin atomic number 82 to a few setbacks. A software update from Ford installed on a USB drive can as well remove the nav. I'll get into this later downwards below. The expense is also a factor as y'all can rarely get the units for less than a few hundred. Sure sites online sell Nav enabled APIMs for over a 1000 or more.
You volition likewise need to buy a navigation SD carte du jour separately. At the fourth dimension of writing (February 2016) the A7 card is newest for North America.
I can independently confirm this method does work. This is my 2013 Ford Fusion SE that was equipped with MFT and no Nav.
What I believe nosotros need to practise to unlock Navigation in our MFT systems
The secret to enabling features is going to exist in the Equally Built Data. ABD. Information technology seems every bit though all MFT cars become the same APIM and what differentiates the features is the ABD. The ABD tells the car which features were purchased and which to be enabled. ABD is not plain text, it exists every bit bits. Comparing the ABD of cars with Nav vs cars without Nav should teach us what modifications nosotros need to brand. The ABD is Not piece of cake to access or alter and will likely involve using proprietary or expensive software to do and so. Ford VCM2 and IDS are a guarantee. ABD is non unique to the APIM, in fact its used in many modules on the car. We are unable to manually change values on the APIM ABD.
We should be able to accomplish this without opening the dash up every bit the solution is within the software, not the hardware.
I found a tool for the Ford Focus that will retrieve ABD and edit it. http://ford.xtlt.ru/
Things to keep in heed:
- Updates for MFT from Ford.com will remove Nav from even a Nav enabled APIM. Equally happened to me. Probably has to do with the ABD (every bit stated above).
-Information technology seems equally though the update files given to a car with Nav are identical to the update files given to a car without Nav. I could be incorrect simply my testing of this is very express. I used the VIN from my car to create an account and download the latest version of the software then I used the VIN from a Nav enabled car and created a separate account and downloaded the latest software. The file name, size, and hash are the same. It is unknown (at least past me) at this fourth dimension if this is the same across the board. Its possible (and likely) the file for the Fusion will differ from the file for say an Escape.
- A downstream USB port exists on the rear of the APIM. Connectivity achieved by utilize of a Ford Rotunda OTC Sync Generation 2 Programming Cablevision.
- Interestingly plenty it seems that all Nav enabled APIMs use the same Navigation license.
- Many (peradventure most) APIMs are all loaded with the Navigation apps already and simply lack the license. Some users on other forums have sucessfully added the license (again the aforementioned on all) but it won't magically run. Probably ABD related likewise.
- Modifying the Naught files for the update install will break the signature and verification used past the MFT and will NOT install.
- The MFT system is custom designed from the ground upwardly. No standard file construction exists in other systems.
- In the erstwhile thread a user jsalzman took his APIM autonomously. He took highly detailed pictures. They can be found Here. Give thanks you!
- Ford IDS cannot be used to change ABD on APIM for MFT.
- It seems jmr061 figured it all out around March 2015. Some of his post history on other forums gives united states of america many clues. Delight don't flame him.
- #4
I highly incertitude it. You need 2 cars with same configuration, one having navigation. Then dump the ABD data, and find the byte that enables nav, change it together with the checksum. Afterwards, y'all will need Ford IDS and Haven to do a reinstall on the module, and swap the ABD file. Well, this is just my estimate, but for sure boosted equipment and paid access to Ford tools is required.Simply more than proof we can figure it out. :highfive:
- #5
From google translate I got this (I know it sounds funny but I hope I didn't change any of it lol)
Comrades! The revolution, the necessity of which for then long asserted Bolsheviks accomplished!)))And at present in order. The procedure consists of the post-obit stages:
- Take the internal configuration APIM car navigation or read the electric current, turn information technology NAVIGATION Application and fill back.
- Make the commutation on the VIN that navigation from the manufacturing plant
- Connect IDS + FORDTECHSERVICE + Oasis and reinstalling the module equally a new SYNC - voila ... a huge thank you to Nicholas Trainer_F for what IDS-tion of the upshot was made possible ...Well, just and so long equally: firmware English, displaying maps in Russian, menus and vocalization guidance in English language. Restayl with the appearance of the ITF and the Russian navigation think maybe it will be possible to exercise in Russian.
- #vi
You stated everything I figured out likewise. I take thoroughly disassembled all the update files and found some interesting clues/ideas on a way in through the software side.
For the hardware side I have a skilful thought how it all works. You lot can use this to edit every bit congenital information w due west westward ucdsys.ru
The APIM as congenital data is programmed to the hardware and will tell the software what is enabled and what is non (Nav, backup cam) If you lot know the Hex values for the as built data and use a third party programming tool you can enable Nav/backup camera through the Tin. In that location is some more than steps for the Nav going this route. You can get the ABD from ford here w due west due west motorcraftservice.com/AsBuilt and compare a similar twelvemonth/model car with NAV/backup camera and one without to figure out the hex values.
What I accept found out on the software side of things:
myfordtouch runs Windows CE/EDB databases via some sqllite commands and then what we all see on the screen is flash (.swf). The update towards the end when it puts the .swf files in does a integrityfilescheck() which verifies the SHA256 hash on these .swf I suspect only. Nothing we tin can do on the SHA256 cheque.
But based on what I was able to dissemble from the update files on SYNCGen2_4.32.14122 file versions. The first thing it runs is the 14D546-EE.cab which saves an XML file on the thumb drive this will list your vin #, part #'s, processes running, space on TFAT,RAM,ROM. ect ect. This one is interesting to annotation the running .exe'south
Before the target images are applied, information technology appears to save "Registry settings" 14D546-AKB talks about gathering current language and and so
"SOFTWARE\Ford\DataManager\gns\system"
"POPUP" NavUnlocked regkey = '%d'"
NavUnlocked
SOFTWARE\Ford\DataManager\gns\ApplicationSettings
Near the end of the update for the epitome files 14D546-AGB it has:
"SOFTWARE\Ford\DataManager\gns\system"
NavUnlocked
SOFTWARE\Ford\DataManager\gns\ApplicationSettings
"%S() Success restoring Nav unlock registry values.
LicenseCount
DPS indicates Navigation has not been unlocked! Get out.
I have created a plan for Windows CE to retrieve the registry info to a text file on the USB bulldoze. I was able to create the CAB and run the CAB, but afterwards about x seconds it errors out with "Invalid or Unsigned File" my cab is unsigned I figured it wasn't going to be this easy. Looking at the update files the cab is signed by "Ford Motor Visitor Internal SYNCGEN2 Issuing CA" and issued to: "Sync Dynamic Code Signing Gen2 A4" within the cab the .999 file that does all the work is signed by "Microsoft Test Software Publish Document" The SYNCGGEN2 is a SHA1 signature hash algorithm. The Microsoft one uses a MD5 hash algorithm and appears to be some random document congenital into the platform builder that says do not use for publishing. I am working on a few methods to become around the signed file. I may try loading the code into a random .jpg or image file and upload information technology to the background surface area and in theory once uploaded and clicked on should run the code. Unproblematic Trojan horse.
Lawmaking in the Appconsole.swf as noted in the prior thread that determines if NAV should exist displayed in the right corner of the screen or if Information should be.
SyncUtilLin797staticfunctionIsNavSystemInstalled()
staticfunctionIsNavSystemInstalled()
{
var_loc1_=false;
if(SyncConst.UseNavOverride)
{
SyncBaseClass.swarning(SyncUtil.sCN,"GetNavSystemStatus
verriding\'IsNavInstalled\'flagtotrue,sinceSyncConst.UseNavOverrideisset.");
_loc1_=true;
}
elseif(Plugins.DataManager)
{
var_loc4_=SyncUtil.GetDMNumber("InboundDiag.NavAppEnabled",1);
var_loc2_=SyncUtil.GetDMNumber("ApplicationSettings.NavUnlocked",0);
var_loc3_=SyncUtil.GetDMNumber("Provisioning.NavInstalled",0);
_loc1_=Boolean(_loc4_==1&&_loc2_==1&&_loc3_==i);
}
else
{
_loc1_=false;
}
SyncConst.IsNavInstalled=_loc1_;
return_loc1_;
}
- #7
Let me know if you need anything off this APIM.
- #eight
I am trying a few thought'south on the signature outcome still. I also thought about taking the NAND wink off the circuit board, simply I don't know if I want to spend the money to buy another APIM simply to accept it apart.
- #9
- #10
Hey all I only bought a 2013 Ford Fusion w/ MFT. Is information technology prophylactic to update MFT or will that decrease the chance of this project working when it comes to be?
Super Jay,
I am currently on version 3.7.11 (SYNCGen2_4.32.14122) the newest is one upward three.8 (SYNCGen2 V38 15128 updatepackage NA Rev1). I have not looked at the newest version 3.viii yet but I can ostend the update three.7.11 released 2014 is however vulnerable to the Microsoft Security Vulnerability (MS13-098) Even though this security update was in 12/2013. / 7/2014
"The security update addresses the vulnerability by modifying how the WinVerifyTrust office handles Windows Authenticode signature verification for portable executable files."
I am able to successfully add additional lawmaking to the .999 file without affecting the digital signature. The problem is in order to add together the data to the .999 file you accept to unpack the .cab file so even though I can get the code in the .999 file and information technology remain a valid digital signature, I am struggling on repacking the .cab in order to get a valid signature at present for the "Ford Motor Visitor Internal SYNCGEN2 Issuing CA".
So I am working on but adding the extra code to the .cab file. I can add the lawmaking to the cab file without breaking the signature it is just more than difficult to empathize the .cab hex layout in terms of the format/headers/pinch compared to a PE file.
Even if someone is able to get full access to the sync arrangement doesn't hateful you can just drib an android image in, problem solved. The android prototype would crave a lot of customization to brand it all work. I am simply looking to come across if I can go far and if at that place is a uncomplicated fashion to activate navigation once in without having to modify the hardware/Every bit built data. If successful then this would open up other possible areas like adding more functions or apps.
- #eleven
I should accept some free time tomorrow to work on this. I'll try and come across if the latest update is notwithstanding vulnerable. If there'due south a more productive way for me to aid out please let me know.
Edit: Removed unnecessary quote
- #12
I'yard willing to buy navigation SD cards simply Ford is not even giving me the pick to open up (purchase) Navi functionality!
- #xiii
I been playing around with "BadUSB" that exploits the USB Phison PS2251-03 (2303) controller. I am all the same working on the firmware to tailor it towards windows ce/myfordtouch.
I volition post the instructions before long on how to enable Navigation/backup camera via the hardware/CAN route, since the software side is more than hard.
Attachments
- #14
Definitely on the correct rails. I got a second Nav enabled APIM today because I wrecked my last one. I carelessly loaded the wrong update file when I was playing around and used the official ford update (not mine which I never expected to piece of work anyways) which disabled Nav. I've still to become around the signature issues.Allow me know if you demand annihilation off this APIM.
I had the same situation. Bricked the NAV when installed the last SYNC update. I could run into the license on the MFT but NAV was no longer functional. After some digging into the update files establish a discrepancy and "crafted" one with the missing files. It worked like a champ. Now my NAV is working again. You can download it here:
------------https://onedrive.live.com/redir?resid=134D09ADEFC20FD3!52459&authkey=!AH57Dq9Jl3Fj71c&ithint=file%2czip
If the Full bundle does not work, PM. I will look for the one I used to load just the renaming NAV pieces. Besides, need a master reset afterwards the update.
Now I need to figure out how to enable the backup camera into this APIM. I lost mine when swapped for NAV.
GL
- #15
Backup camera could exist enabled by obd2 cable (stn1170) and FoCCCus software.I had the same state of affairs. Bricked the NAV when installed the last SYNC update. I could run into the license on the MFT simply NAV was no longer functional. After some digging into the update files found a discrepancy and "crafted" one with the missing files. It worked like a champ. Now my NAV is working again. You can download it here:
------------https://onedrive.live.com/redir?resid=134D09ADEFC20FD3!52459&authkey=!AH57Dq9Jl3Fj71c&ithint=file%2czipIf the Full packet does non work, PM. I will look for the i I used to load just the renaming NAV pieces. Too, demand a master reset subsequently the update.
At present I need to effigy out how to enable the backup camera into this APIM. I lost mine when swapped for NAV.
GL
- #16
I had the same situation. Bricked the NAV when installed the last SYNC update. I could encounter the license on the MFT but NAV was no longer functional. Later some digging into the update files establish a discrepancy and "crafted" 1 with the missing files. It worked similar a champ. Now my NAV is working again. You can download it here:
------------https://onedrive.alive.com/redir?resid=134D09ADEFC20FD3!52459&authkey=!AH57Dq9Jl3Fj71c&ithint=file%2czipIf the Full package does non work, PM. I will look for the one I used to load simply the renaming NAV pieces. As well, need a chief reset after the update.
Now I need to effigy out how to enable the backup camera into this APIM. I lost mine when swapped for NAV.
GL
Dr3X,
Thanks for the files. I but noticed EA5T-14D544-AD.zippo is non digital signed nor is the .sec file. I am assuming you used this and it worked? I will have to await at that .sec some more, I never really looked at information technology since it is a 2GB file uncompressed, but if the system will allow that file with no digital signature that is interesting.
- #17
-----------https://onedrive.live.com/redir?resid=134D09ADEFC20FD3!55786&authkey=!AMRvmLCVKv7eBUs&ithint=file%2czip ---------- Post added at 04:45 PM ---------- Previous post was at 04:39 PM ----------
Fill-in camera could be enabled by obd2 cable (stn1170) and FoCCCus software.
Can you point me on the right direction to get them?
Thank you
- #18
It seems that ZIP-s are signed too.Dr3X,Cheers for the files. I just noticed EA5T-14D544-AD.zip is not digital signed nor is the .sec file. I am assuming you used this and it worked? I will accept to look at that .sec some more, I never really looked at it since it is a 2GB file uncompressed, only if the organisation volition permit that file with no digital signature that is interesting.
- #nineteen
It seems that Zero-southward are signed too.
When I right click the .zip files I don't encounter a digital signature tab, I also ran the nada files through sigcheck and it says it is unsigned. There is just one .nothing file that does not comprise a digital signed .CAB file in it. That is the .sec file found in EA5T-14D544-AD.zilch or EA5T-14D544-AC*.aught (Depending on sync upload files/version you have)
Edit: I ran the .sec file through strings.exe looking at the Unicode text in the file and find it interesting as it talks most like at that place is a windows desktop there with internet explore, FTP, offline mode/this page is secure/you will be redirected ect ect. I attached a screen capture of a portion of the print out. The file is 2gb so I only printed about 10mb in a command console.
- #20
Can yous point me on the correct management to go them?Thanks
What car practice you accept?
I accept ford focus mk3 and Focccus is skilful for it.
If you lot have other ford probably Forscan is for you. If you have focus mk3.5 or mondeo mk4 and so probably only ucds cable is ok (from russia).
In that location is as well IDS, but it is expensive.
You could find someone with proper cable and knowledge in your area.
I could help with Focccus equally I apply it. ---------- Post added at 08:59 PM ---------- Previous postal service was at 08:55 PM ---------- ---------- Postal service added at 09:xiii PM ---------- Previous post was at 08:59 PM ----------
http://world wide web.focusfanatics.com/forum/showthread.php?p=5863970
Change BCM value
"99" "Park assistance camera"
to option "02" With Park Assist Camera.
That's information technology.
Like threads
Source: https://forum.xda-developers.com/t/myford-touch-system-hack-enable-features-navigation-rear-view-camera-etc.3321397/
Posted by: goodmanwheroulatis1952.blogspot.com
0 Response to "How To Resert Rear View Camera On 2015 Mustang Without Navigation"
Post a Comment