[GUIDE] How to gain root shell on 2016 Honda Pilot (and now install apps!!!)

[tonyyang84]

anyone have original 2016 pilot exl non Nav factory_reset.sh file ?

 

[TimR1]

anyone have original 2016 pilot exl non Nav factory_reset.sh file ?

Here you go.

 

[tonyyang84]

Here you go.

thanks! thanks! thanks!:good:

 

[hyperfire21]

I was thinking of buying a 2016 pilot. Has there been any progress in getting Carplay working on it?

 

[trent99]

After about a month of use, this is so great. I love using Waze through the car. And Spotify is really nice to have too. I did the process on my dad's 16 Touring and my brother in law's 17 Touring as well. Both seemed to work fine. Thanks to all for your hard work on this!

 

[mali1621]

Tried Did not Work! Thanks in Advance

Hello,
First, thank you for the noob guide! Much Appreciated
I tried following the steps and got this message
I have a 2017 Honda Accord Ex, 6spd.
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Mohammed Ali>cd c:\hondahack\OneClick

c:\hondahack\OneClick>OneClickInstall.bat 172.20.10.13 waze.apk

c:\hondahack\OneClick>.\bin\bash.exe .\OneClickInstall.sh 172.20.10.13 waze.apk

Usage: ./OneClickInstall.sh ipaddress My.apk
Example: ./OneClickInstall.sh 192.168.1.100 Waze.apk
Disconnecting other adb devices\n
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
disconnected everything
Connecting to 172.20.10.13\n
connected to 172.20.10.13:5555
Checking for root...
No root yet, addressing the situation
Attempting to push payloads to /data/local/tmp/rootme\n
[100%] /data/local/tmp/rootme/factory_reset_mod.sh
[100%] /data/local/tmp/rootme/dirtycow
[100%] /data/local/tmp/rootme/nefarious.sh
[100%] /data/local/tmp/rootme/su
Exploiting dirtycow to replace factory_reset.sh with our own\n
warning: new file size (60) and file old size (3489) differ

size 3489


[*] mmap 0x401fa000
[*] exploit (patch)
[*] currently 0x401fa000=732f2123
[*] madvise = 0x401fa000 3489
[*] madvise = 0 1048576
[*] /proc/self/mem -636485632 1048576
[*] exploited 0x401fa000=732f2123
Okay - should be all set, initiate factory reset and hope for the best!
Go to Home ->Settings->System->Factory Data Reset (scroll all the way down) and
ititiate factory reset, press enter when unit has rebooted & reconnected to WiFi


Okay - checking for successfull root\n
disconnected everything
connected to 172.20.10.13:5555
.\OneClickInstall.sh: Hmm, didn't get root. Aborting further operations.: comman
d not found


Thank you again for the help!

 

[salman499]

I have the same issue. Running windows 10 and I have Java SE runtime installed. Anyone have any clues what I'm missing?

Thanks.

I was able to fix this by downloading the oneclick install file from this post rather than using the one from github. Hope this helps.

 

[brownsta]

Can't get apk signature

Another quick thought that I can add to the tutorial. In my situation, I was unable to get my car a steady connection to my home network. The router is at one end of the house and the cars are parked outside on the other. I could connect sporadically, but the last thing you want is to lose connection while the script is running and have a half uploaded file!

One solution is to take any old wireless router and plug it in near your Honda. As long as your PC of choice was a laptop, or it at least in range of this router, this will work. The router doesn't need to connect to the internet to work. All you need is the vehicle and computer to be on the same network. As long as the router is plugged into the wall and both devices can see it, they should be able to connect and communicate.

Hi! Really appreciate your help!! Everything was going smooth until I couldn't get the apk signature. Do you know how I could fix this? Thanks!!

 

[ammarbukhari]

Here you go.

What will be the benefit of the reset files. What will it do to the system. Can any one tell me.

 

[SturdyErde]

Great. Please let me know when you have the reset file.

I finally went to the Honda dealer (busy month) and they did a software update for me. There were no features or enhancements, just big fixes, apparently. I asked for a copy of the flash drive or the file, but was told that Honda will not allow them to give it out.

---------- Post added at 08:37 PM ---------- Previous post was at 08:34 PM ----------

Oh, another piece of info about how Honda will be doing this in the future:

The Honda service rep that I spoke with said that Honda corporate came to their dealership and installed a completely separate WiFi network specifically for future software updates. When you drive your 2018 Odyssey into the service area, the car will automatically connect and install any available software updates! Cool, creepy, convenient, and everything all at once!

 

[TimR1]

What will be the benefit of the reset files. What will it do to the system. Can any one tell me.

The OneClickInstall.bat overwrites the original reset file in order to enable installation of new apps. Replacing the reset file will allow you to return the head unit to a more stock configuration. I haven't actually put the original reset file back on, but if I remember correctly others that have done it said it removed the new apps.

 

[codeage]

I own a 2017 Civic EX-t and thought I would share what I have learned.

First, it does have Android Auto and CarPlay.
The ADB port is not open.
Port 5000 is open.
It will connect to the Internet through my Android phone using Bluetooth.
There is a hidden menu that can be accessed with power-brightness-menu for two seconds and selecting the bottom box
From that hidden menu there is another menu accessed through holding Menu.
From that menu there is another hidden menu -- press and hold the home key. Ignore the three beeps. keep holding it until it beeps once more.
That menu seems to let you change the USB port functions between host and device modes.

I've not screwed with those yet, but it might be an attack vector.

ewaller@turing ~ 1003 %nmap 192.168.1.87 -p1-65535

Starting Nmap 7.40 ( https://nmap.org ) at 2017-02-03 13:06 PST
Nmap scan report for android-9500bed69ff35d8f (192.168.1.87)
Host is up (0.0029s latency).
Not shown: 65534 closed ports
PORT     STATE SERVICE
5000/tcp open  upnp

Nmap done: 1 IP address (1 host up) scanned in 199.43 seconds
ewaller@turing ~ 1004 %

Edit, oh and if you tap a bunch of times on the build number in the version menu, it does not enable developer mode, it asks for the infamous "passcord"

Finally somebody found a way to enter the developer mode: https://xdaforums.com/android/general/guide-how-to-enter-developer-mode-2017-t3621582

 

[lunknowl]

hi , i just want to makesure that i will not messup my car. is this work on the 2017 honda accord exl? if it does, can you show me how to do it? i just want a mirror link for my car , thanks

 

[yuprules]

Finally somebody found a way to enter the developer mode: https://xdaforums.com/android/general/guide-how-to-enter-developer-mode-2017-t3621582

Whoa! One step closer to installing offline GPS apps my Honda 2017 CRV! Awesome!

 

[khemraj1999]

Wow! this is the greatest forum i've ever found!

I will be attempting this over the weekend on a 2017 Honda Accord EX w/ HS.

I know some people may be looking for a factory image of this car? Prior to playing around and modifying it, i can take the factory image for you. Please tell me how and i'll do it and upload it here.


Thanks!

 

[TimR1]

Wow! this is the greatest forum i've ever found!

I will be attempting this over the weekend on a 2017 Honda Accord EX w/ HS.

I know some people may be looking for a factory image of this car? Prior to playing around and modifying it, i can take the factory image for you. Please tell me how and i'll do it and upload it here.


Thanks!

I don't believe that anyone has figured out how to get a complete factory image for any Hondas that this works on.

However, several people are looking for copies of the original factory_reset.sh files for various models. This file gets overwritten when you run the OneClickInstall batch file, so you need to copy it prior to that. If you are following Living Lejuhnd's guide in post #404 (which I'd recommend) then you can pull a copy of the reset file by executing the following commands right before you run OneClickInstall.bat:

adb connect 192.168.1.200
adb pull /system/etc/factory_reset.sh

This will create a copy of the factory_reset.sh file from your Honda and put it on your PC in the directory that you are in the command prompt (C:\hondahack\OneClick\).

-Tim

 

[khemraj1999]

I don't believe that anyone has figured out how to get a complete factory image for any Hondas that this works on.

However, several people are looking for copies of the original factory_reset.sh files for various models. This file gets overwritten when you run the OneClickInstall batch file, so you need to copy it prior to that. If you are following Living Lejuhnd's guide in post #404 (which I'd recommend) then you can pull a copy of the reset file by executing the following commands right before you run OneClickInstall.bat:

adb connect 192.168.1.200
adb pull /system/etc/factory_reset.sh

This will create a copy of the factory_reset.sh file from your Honda and put it on your PC in the directory that you are in the command prompt (C:\hondahack\OneClick\).

-Tim

Thanks for the reply Tim!

So basically this factory_reset.sh file will restore the headunit if it gets bricked?

 

[TimR1]

Thanks for the reply Tim!

So basically this factory_reset.sh file will restore the headunit if it gets bricked?

If it is truly bricked I don't think you'll be able to get back in to replace the factory_reset.sh file. Obviously someone may figure out a path in the future though or there may be other situations where it would be useful to have it.

To be honest, I haven't had a need for my original reset file. I was just leery of overwriting it without keeping a backup copy.

-Tim

 

[khemraj1999]

If it is truly bricked I don't think you'll be able to get back in to replace the factory_reset.sh file. Obviously someone may figure out a path in the future though or there may be other situations where it would be useful to have it.

To be honest, I haven't had a need for my original reset file. I was just leery of overwriting it without keeping a backup copy.

-Tim

I will post mine just in case someone needs it. All i want is to bypass the function to stop video when driving so my passenger can watch a show while i drive. I'll most likely attempt kodi and netflix only.

 

[ir1shboy]

Wow!

I just found this thread and am pumped! I just purchased a 2017 Honda Pilot EX and was playing with the browser then stumped onto this. Ian it possible to root system And watch videos while driving???