I would be interested in unlocking the gps typing while driving, and anyway to get ANdroid auto on there
I'm not much of a coder, more of a technical re-writer but definitely interested in what you are doing here. Keep at it.
I've got a 2014 RAM RA4 (same pn as the Cherokee) and several of us at RamForum have upgraded/modified our truck wiring to work fully with them. Also been keeping track of RAM fw here.
Many of us would be interested in unlocking the other features, maybe customizing the text for backup camera, and access/change themes that are already in the swdl.iso update but not available for the specific vehicle.
I've poked around a bit in the my15 VP4 15.17.5 master file using notepad ++, and 7zip. Trying to see if it might be possible to get the 4.05gb /NAV folder to install on 2013/2014 Ra4 for updated maps. Still evaluating the risk.
Sent from my LG G4 on Tapatalk.
I've got a 2014 RAM RA4 (same pn as the Cherokee) and several of us at RamForum have upgraded/modified our truck wiring to work fully with them. Also been keeping track of RAM fw here.
Many of us would be interested in unlocking the other features, maybe customizing the text for backup camera, and access/change themes that are already in the swdl.iso update but not available for the specific vehicle.
I've poked around a bit in the my15 VP4 15.17.5 master file using notepad ++, and 7zip. Trying to see if it might be possible to get the 4.05gb /NAV folder to install on 2013/2014 Ra4 for updated maps. Still evaluating the risk.
Sent from my LG G4 on Tapatalk.
Last edited:
Im just now starting to get back into decompiling the lua bytecode, for reference for anyone else wondering how to decompile lua i use this --> https://sourceforge.net/projects/unluac/ it requires the debugging info not be stripped from the lua but thankfully since its enabled to be included by default by the compiler, chrysler didnt seem to bother to disable it 
Found something interesting, digging further ive found that the app system that is run is the Xlet java framework. Knowing this i went and decompiled the program called kona, which i think is more of a master application manager for the entire system, digging inside the code a found a class file marked OpenNavActiviation.java and the code makes references to the dbus service com.harman.service.opennav.OpenNavActivationImpl. ive posted the code below, however this looks like the key to enabling the Navigation on non-navigation units, like the dealer can, but without having to pay them >
Code:
/*
* Decompiled with CFR 0_114.
*/
package kona.opennav;
import com.harman.logger.SystemLogger;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import kona.opennav.OpenNavActivationListener;
import kona.opennav.OpenNavException;
import kona.opennav.OpenNaviPackageDescription;
import net.sf.microlog.core.Logger;
public class OpenNavActivation {
public static final int ACTIVATION_CODE_STATUS_SUCCESS = 0;
public static final int ACTIVATION_CODE_STATUS_FAILURE = -1;
private static final String OPENNAVACTIVATION_CLASS_PATH = "com.harman.service.opennav.OpenNavActivationImpl";
private static OpenNavActivation openNavActivation;
private Class openNavActivationImplClass = null;
private Object openNavActivationImplObject = null;
private OpenNavActivation() throws OpenNavException {
try {
this.openNavActivationImplClass = Class.forName("com.harman.service.opennav.OpenNavActivationImpl");
}
catch (ClassNotFoundException e) {
e.printStackTrace();
}
if (this.openNavActivationImplClass == null) {
throw new RuntimeException("OpenNavActivation service is not supported.");
}
try {
Method getInstanceMethod = this.openNavActivationImplClass.getDeclaredMethod("getInstance", new Class[0]);
if (getInstanceMethod != null) {
try {
this.openNavActivationImplObject = getInstanceMethod.invoke(null, new Class[0]);
}
catch (IllegalArgumentException e) {
SystemLogger.LOGGER.error("OpenNavActivation: contructor ", e);
this.openNavActivationImplObject = null;
}
catch (IllegalAccessException e) {
SystemLogger.LOGGER.error("OpenNavActivation: contructor ", e);
this.openNavActivationImplObject = null;
}
catch (InvocationTargetException e) {
SystemLogger.LOGGER.error("OpenNavActivation: contructor ", e);
e.printStackTrace();
this.openNavActivationImplObject = null;
}
}
}
catch (SecurityException e) {
SystemLogger.LOGGER.error("OpenNavActivation: contructor ", e);
this.openNavActivationImplObject = null;
}
catch (NoSuchMethodException e) {
SystemLogger.LOGGER.error("OpenNavActivation: contructor ", e);
this.openNavActivationImplObject = null;
}
if (this.openNavActivationImplObject == null) {
throw new OpenNavException("Navigation Service is not available.");
}
}
public static OpenNavActivation getInstance() throws OpenNavException {
if (openNavActivation == null) {
openNavActivation = new OpenNavActivation();
}
return openNavActivation;
}
public void registerOpenNavActivationListener(OpenNavActivationListener activationListener) throws OpenNavException {
try {
Class[] arrclass = new Class[1];
Class class_ = OpenNavActivationListener.class;
arrclass[0] = class_;
Method getActivationPkgListMethod = this.openNavActivationImplClass.getMethod("getNaviPackageListForActivation", arrclass);
try {
getActivationPkgListMethod.invoke(this.openNavActivationImplObject, activationListener);
}
catch (IllegalArgumentException e) {
SystemLogger.LOGGER.error("OpenNavActivation: registerOpenNavActivationListener ", e);
}
catch (IllegalAccessException e) {
SystemLogger.LOGGER.error("OpenNavActivation: registerOpenNavActivationListener ", e);
}
catch (InvocationTargetException e) {
SystemLogger.LOGGER.error("OpenNavActivation: registerOpenNavActivationListener ", e);
throw new OpenNavException("Navigation Service is not available.");
}
}
catch (SecurityException e) {
SystemLogger.LOGGER.error("OpenNavActivation: registerOpenNavActivationListener ", e);
}
catch (NoSuchMethodException e) {
SystemLogger.LOGGER.error("OpenNavActivation: registerOpenNavActivationListener ", e);
}
}
public int setActivationCode(OpenNaviPackageDescription packageDiscription) throws OpenNavException {
int code;
if (packageDiscription == null || packageDiscription.getActivationCode() == null) {
throw new NullPointerException("OpennaviPackageDescription and activationCode should not be null");
}
code = -1;
try {
Class[] arrclass = new Class[1];
Class class_ = OpenNaviPackageDescription.class;
arrclass[0] = class_;
Method method = this.openNavActivationImplClass.getMethod("applyActivationCode", arrclass);
try {
Object objectCode = method.invoke(this.openNavActivationImplObject, packageDiscription);
code = (Integer)objectCode;
}
catch (IllegalArgumentException e) {
SystemLogger.LOGGER.error("OpenNavActivation: setActivationCode ", e);
}
catch (IllegalAccessException e) {
SystemLogger.LOGGER.error("OpenNavActivation: setActivationCode ", e);
}
catch (InvocationTargetException e) {
SystemLogger.LOGGER.error("OpenNavActivation: setActivationCode ", e);
throw new OpenNavException("Navigation Service is not available.");
}
}
catch (SecurityException e) {
SystemLogger.LOGGER.error("OpenNavActivation: setActivationCode ", e);
}
catch (NoSuchMethodException e) {
SystemLogger.LOGGER.error("OpenNavActivation: setActivationCode ", e);
}
return code;
}
public boolean isNavActivated() throws OpenNavException {
boolean isNavActive;
isNavActive = false;
try {
Method isNavActiveMethod = this.openNavActivationImplClass.getDeclaredMethod("isNavActivated", new Class[0]);
try {
Boolean returnVal = (Boolean)isNavActiveMethod.invoke(this.openNavActivationImplObject, new Class[0]);
isNavActive = returnVal;
}
catch (IllegalArgumentException e) {
SystemLogger.LOGGER.error("OpenNavActivation: isNavActivated ", e);
}
catch (IllegalAccessException e) {
SystemLogger.LOGGER.error("OpenNavActivation: isNavActivated ", e);
}
catch (InvocationTargetException e) {
SystemLogger.LOGGER.error("OpenNavActivation: isNavActivated ", e);
throw new OpenNavException("Navigation Service is not available.");
}
}
catch (SecurityException e) {
SystemLogger.LOGGER.error("OpenNavActivation: isNavActivated ", e);
}
catch (NoSuchMethodException e) {
SystemLogger.LOGGER.error("OpenNavActivation: isNavActivated ", e);
}
return isNavActive;
}
}this actually looks pretty cool. anyone actually done this to see if it works?
I am going to assume (I may be wrong) but this is still Android 4.4.4. Anyone who pays that amount of money on a device that has Android 4.4.4. is absolutely crazy.
I'd assume that they didn't actually install android on the uconnect, but are connecting it to a separate android box. I wouldn't think it would be too hard to connect the resistive touchscreen to an adapter for android. After that all you would need is a lockpick to accept a new video input.
So glad I stumbled upon this thread, I would love to see where this goes. When my gf got her 15 jeep renegade my first thoughts were "how can we hack/modify this u connect thing..." I wish i were more knowledgeable in development and coding to mess with it, don't want to really mess up my gf car and deal with THAT dog house..
That is exactly what I was planning to attempt, but someone smashed my window and stole the uconnect before I got around to it. Ended up going aftermarket AppRadio. The touch controller I found (mimcs-x2)is listed as out of stock and supposedly there will be a newer model. It was Bluetooth enabled so using it and the lockpick air would have been a totally wireless solution.
Here are some links if anyone is interested.
http://www.google.com/url?q=http://...ggaMAE&usg=AFQjCNEM_VUymX5UbS9b5qgjB6SuEgwbFw
http://www.google.com/search?q=mimi...ac.1j4.34.heirloom-serp..12.1.252.KtXDldeO6nw
On a side note Joe that makes the Tranzformer and Tazer from post #3 in this thread has mentioned in forum posts he would be willing to share his voodoo with someone wishing to develop an Android app.
So I am one of the people to spend a boatload of money on a system running Android 4.4.4. I realize it's a bunch of money but it's not something I was going to be able to make on my own and I wanted to make my uconnect more feature rich and this had better options to me than the JAX or Lockpick options did. It's basically and Android box with inputs and outputs and has a circuit board you hook up inside the uconnect head unit that allows the Android system to access the touchscreen and monitor. There are some limitations I am finding but overall I am pleased. Not having a multi-touch touchscreen has some minor limits but you can still do most everything. I am going to make a post in this forum to see if anyone can help me figure out the other 2 issues I am dealing with but if anyone wants further info about this setup feel free to ask.
The setup I linked to? The one question I had after watching their video is whether it has voice input?
Yea the one from Carperformance.se.
Yes it does have voice input, it comes with a mic. I use it for OK Google commands. The one crappy thing is I am unable to make OK Google detection happen from any screen, the option is just not available even though I have the most updated versions running, but that is more of Google not letting that option be used for this. I would love to find a workaround though. For now I just push the button on the home screen and say what I want.
And disregard my complaint in my other post I started about using a different launcher, it seems as though it's something related to my particular device. I spoke with another guy that has it and he's been running the Nova launcher for a while now and has never had it factory reset.
i just bought the carperformance system. hope to get it today and install ...
I just read the PDF installation directions, please let me know how invasive the installation ends up being. $550 dollars is super steep but im very interested. Thanks!
That depends on what you consider invasive. You ha e to open up the back of the radio to connect the additional circuit board, but it is just a matter of detaching and reattaching some data cables, no soldering or anything crazy.
https://www.youtube.com/watch?v=-hSZxRKMVcM&feature=youtu.be
was pretty easy
works very good.
---------- Post added at 12:19 AM ---------- Previous post was at 12:13 AM ----------
did the nova launcher work well with it?
i installed mine yesterday. never tried nova launcher..
So the launcher thing might be a slight issue, I had to get an older version of the box sent out to me because for some reason the new one would crash after installing a different launcher, yours might be the same. I made them aware of it so they are talking with their manufacturer to fix it. I would test it before loading everything up because the crash wipes everything.
Hey, interesting thread.
I am actually looking for the complete opposite!
Having and old charger 2006 (low speed canbus) I got a aftermarket HU with native Android 5.1.1 on it. I am not impressed with the OS in relation to being automotive adaptable.
I can do everything thing Internet-ish, etc. But the actual functions for driving a car are not really optimized for such. E.g. Most apps steals the whole screen, so no info bar.
E.g. When navigation app is used, you cant change or even see what radio or music you might have playing, let alone easily change it.
Fiddling around while driving to do a simple thing as changing radio station, is actually dangerous.
So, I was contemplating if it would be possible to change the firmware completely with this Uconnect, but I cant find any downloads of the whole thing, to tinker with.
On the RAX and the "performance" guys in Halmstad; totally crazy prices, but they are both Swedish. They are essentially just making mirroring available on your U-connect systems.
For less than 300 bux you could get and install 2nd HU or tablet style unit with Lollipop, which, in my opinion would be a much smarter solution. Think about having 2 screens in your cockpit, providing different types of information and functions. This is much better than to try and multitask your one screen to give you as much information as you want, at a glance while driving.
cheers
I am actually looking for the complete opposite!
Having and old charger 2006 (low speed canbus) I got a aftermarket HU with native Android 5.1.1 on it. I am not impressed with the OS in relation to being automotive adaptable.
I can do everything thing Internet-ish, etc. But the actual functions for driving a car are not really optimized for such. E.g. Most apps steals the whole screen, so no info bar.
E.g. When navigation app is used, you cant change or even see what radio or music you might have playing, let alone easily change it.
Fiddling around while driving to do a simple thing as changing radio station, is actually dangerous.
So, I was contemplating if it would be possible to change the firmware completely with this Uconnect, but I cant find any downloads of the whole thing, to tinker with.
On the RAX and the "performance" guys in Halmstad; totally crazy prices, but they are both Swedish. They are essentially just making mirroring available on your U-connect systems.
For less than 300 bux you could get and install 2nd HU or tablet style unit with Lollipop, which, in my opinion would be a much smarter solution. Think about having 2 screens in your cockpit, providing different types of information and functions. This is much better than to try and multitask your one screen to give you as much information as you want, at a glance while driving.
cheers
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
1
Just completed this on my MY14, thanks for the detailed writeup. For the case of MY14 I enabled the cargo cam but it caused my reverse camera not to automatically enable when in reverse, I also didn't have the option to switch between cameras using the display.
As a work around I made an lua script to run on boot that hooks onto the "Back" button to cycle through the cameras. (It can probably be simplified or improved but works for me for now):
Code:local service = require("service") local methods = {} local myservice local myICSKeys = "com.harman.service.ICS" local layerManager = "com.harman.service.LayerManager" local currentStatus = 0 local function emit(signal, params) service.emit(myservice, signal, params) end local function invoke(busname, method, params, timeout) return service.invoke(busname, method, params, timeout) end local function subscribe(name, signal, handler) assert(type(handler) == "function") return assert(service.subscribe(name, signal, handler)) end local function onCameraChangeRequest(signal, data) if data.key == "back" and data.pressed == true then dbg.print("Camera Change requested") if currentStatus == 0 then currentStatus += 1 service.invoke(layerManager,"viewCameraInput") elseif currentStatus == 1 then currentStatus += 1 service.invoke(layerManager,"viewVES1Input") else currentStatus = 0 service.invoke(layerManager,"stopViewInput") end end end local function init() myservice = assert(service.register("com.harman.service.CargoCam", methods)) subscribe(myICSKeys, "key", onCameraChangeRequest) end init() -
10DISCLAIMER:
Doing anything i describe in this thread is at YOUR OWN RISK, if your Jeep suddenly dies on the highway im not responsible, but if your jeep magically gets 200 MPG or limitless fuel i take full credit
So studying the white paper from those security researchers that hacked the jeep over the sprint network and about a half a days worth of tinkering with the uconnect iso update file, i was finally able to get it to take the modifications, changing root password and editing boot script to run commands from script on USB flash drive, but now I'm at a loss not really sure what to do now.
I just finished dumping the entire file system to the flash drive for analysis but other than that I don't know, I'm not familiar at all with qnx or even any embedded Linux for that matter so I'm just posting here to see what you guys can come up with.
One goal of mine is to bring up the hotspot manually without having to pay for it so I can establish a proper ssh terminal, but im dreaming of either running android over top of the jeeps interface or replacing it entirely (maybe someday)
Here's the link to the whitepaper
ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf
Ok so i decieded to do a quick run down of what i did,
First, using a hex editor on the 14.05.03 iso update file, at offset 0x80 insert an 'S' 0x53, on 14.05.03 ONLY this will bypass the initial ISO integrity on anything later the white paper describes a way to 'trick' the check. It involves 2 usb one with a modified ISO and one with a legit ISO. i have never done it this way, but i will describe it anyways: insert the USB with legit ISO, click yes on the pop-up, when the screen turns completely off immediately remove the USB and insert the one with the modified ISO
Second i changed the root password at offset 0x5dd34b4 to 8CNGLiYvSaCbg which is "root"
And lastly i inserted the code that will run scripts contained in 'cmds.sh' located on a usb flash drive, now this is tricky, orginially theres this line:
''# Start Image Rot Fixer, currently started with high verbosity"
make it look like this before you insert the line of code:
"######rently started with high verbosity"
now after the "-d -p 2000 .." insert "sh /fs/usb0/cmds.sh &" and make sure that after the '&' and before the first '#' there is a line termination hex code 0x0a
And that's it, type up a script called 'cmds.sh' and put it on a FAT32 formatted flash drive and your good to go
The directory list:
pastebin.com/BKfSptbH
and a list of available commands
pastebin.com/jLTaEEge
Would it be a good idea to upload the actual dump from the file system?
for ****s and giggles, live long and prosper:
Last thing, most of the credit goes to Chris Valasek and Chris Miller the security researchers that paved the way and published the white paper, i just studied it and put the actual rooting process in an easier format.4
Sorry - have been away / busy with work... only just remembered about this thread. I have written some very basic instructions below, you will need to work out the rest / where to get the files from properly, etc. And as always, do this at your own risk, if you don't know what you're doing and end up missing files or bricking your cars radio, then its your own fault (dealer wont help ya out of this mess)... however on this note - if you do get in a sticky situation I have found its not very hard to reset and start over with fresh firmware, I created a self-updating FW iso by modifying an older ISO which can be patched to auto-start on USB plugin.
You will need to patch the files based on your given Firmware Level and Model Year / uConnect type... for example FW 15.26.1 MY14 RJ3/RJ4 files differ to FW 16.13.13 MY15 RJ3/RJ4, etc.
You will also need to buy an iGO map license (~$30AU on Android for Australia - other locations cost more) and grab the files (.lyc) and the map files (requires rooted Android to access the license file, the rest are in the SDCard storage).
Put the following files onto a USB in the root directory:
- A patched swdl.iso modified to run "script.lua" instead of the upgrades
- A patched NaviServer file enabled to allow ANY device License for iGO navigation map licenses. I call mine NaviServer2 so it doesn't conflict with the onboard one. You will need to grab this file off the uconnect from the /bin dir and then patch it using IDA Pro.
- A copy of the nav.sh and navRestart.sh files from the uconnect /fs/mmc0/app/bin folder (or from the Firmware Update DVD iso file), modified to run NaviServer2 command instead of NaviServer - i.e. patched naviserver, with unlocked device licensing.
- A RABCDAsm modified main.swf to "Push True" for SRT and Navigation options (if you want SRT backgrounds and startup logos/app logo, and if you don't have Navigation enabled by default i.e. Jeep Laredo model).
- The map files into a folder called "content", with all your map files (3dc, 3dl, fbl, fda, fjw, fpa, fsp, ftr, hnr, ph, poi, spc), they need to sit in the correct subfolders based on iGO map file locations. (see screenshots)
- For activating the SRT Apps, patch the xlet files to allow them to run without "conditions" in the xlet_properties files, stick them into a "xlets" directory on usb stick.
- script.lua LUA script (contents shown below)
script.lua contains following content, note: I am using Australia maps, obviously you need to change it for your own maps, and also for your own NaviServer file (if you want to call it different).
NOTE: If you don't want to modify your XLETs (apps) or are unsure, then remove the lines about xlets below in the script.
Code:#!/usr/bin/lua local os = os -- copy patched main.swf, nav.sh, navRestart.sh, NaviServer2 os.execute("cp -f /fs/usb0/main.swf /fs/mmc0/app/share/hmi") os.execute("cp -f /fs/usb0/nav.sh /fs/mmc0/app/bin") os.execute("cp -f /fs/usb0/NaviServer2 /fs/mmc0/app/bin") os.execute("cp -f /fs/usb0/navRestart.sh /fs/mmc0/app/bin") -- remove old maps, copy new map files from usb0 content folder os.execute("rm -rf /fs/mmc0/nav/NNG/content/building/Australia*") os.execute("rm -rf /fs/mmc0/nav/NNG/content/map/Australia*") os.execute("rm -rf /fs/mmc0/nav/NNG/content/phoneme/Australia.ph*") os.execute("rm -rf /fs/mmc0/nav/NNG/content/poi/Australia*") os.execute("rm -rf /fs/mmc0/nav/NNG/content/speedcam/Australia*") os.execute("cp -rf /fs/usb0/content /fs/mmc0/nav/NNG") -- copy map license files os.execute("cp -f /fs/usb0/*.lyc /fs/mmc0/nav/NNG/license") -- !!!!! remove old XLETS and copy patched xlets to mmc1 ( OPTIONAL : Remove the following 5 LINES if you dont have modified XLETS to copy over ) !!!!! os.execute("mount -uw /fs/mmc1/") os.execute("rm -rf /fs/mmc1/kona/preload/xlets/*") os.execute("rm -rf /fs/mmc1/xletsdir/xlets/*") os.execute("cp -rf /fs/usb0/xlets/* /fs/mmc1/kona/preload/xlets") os.execute("cp -rf /fs/usb0/xlets/* /fs/mmc1/xletsdir/xlets") -- change permissions for new files copied os.execute("chmod 555 /fs/mmc0/app/share/hmi/main.swf") os.execute("chmod 755 /fs/mmc0/app/bin/nav.sh") os.execute("chmod 755 /fs/mmc0/app/bin/NaviServer2") os.execute("chmod 755 /fs/mmc0/app/bin/navRestart.sh") os.execute("chmod 555 /fs/mmc0/nav/NNG/content/building/Australia*") os.execute("chmod 555 /fs/mmc0/nav/NNG/content/map/Australia*") os.execute("chmod 555 /fs/mmc0/nav/NNG/content/phoneme/Australia*") os.execute("chmod 555 /fs/mmc0/nav/NNG/content/poi/Australia*") os.execute("chmod 555 /fs/mmc0/nav/NNG/content/speedcam/Australia*") os.execute("chmod 555 /fs/mmc0/nav/NNG/license/*.lyc") os.execute("chmod 555 -R /fs/mmc1/kona/preload/xlets") os.execute("chmod 555 -R /fs/mmc1/xletsdir/xlets") -- remount mmc0/1 as read-only mode os.execute("mount -ur /fs/mmc1/") os.execute("mount -ur /fs/mmc0/") -- stop mmc mount and end script os.execute(mountpath.."/usr/share/scripts/mmc.sh stop")
Screenshot of the full USB folder/file tree once prepared:
- Highlighted Yellow files have been modified from Originals.
- Highlighted Green files are completely new files replacing Originals if exist.
- Highlighted Blue file is custom LUA script file for above code content.
- Non-Highlighted files are untouched Originals.
Screenshot by Lightshot
And here is what it looks like on the actual USB stick in Explorer:
Screenshot by Lightshot4And now for something completely (slightly) different.
FRONT CAMERA (cargo cam) Install:
Why: Because I can, also the car washes in the UK are much narrower than in the USA so hopefully will mean I do not have to get out of the car to check my wheel placement when using a car wash in the UK.
A: You will need this https://www.zautomotive.com/product/z_vid/ (female rca video cable with correct terminal pins) Note: postage to the UK is 82 dollars (they do not ask or tell you this before hand). Or save money and make your own cable - correct terminal pins link is below.
B: You will need a camera kit. My Uconnect is 480i only. https://www.amazon.co.uk/dp/B0BZTX3XV7 (It is my understanding that using 720p will not work on my Uconnect, So be carefully with camera settings)
C: I used a micro 2 fuse tap to provide power to the camera from the engine fuse box. https://www.amazon.co.uk/dp/B09VYQGPZZ
D: You will need plastic trim removal tools (These are a must, bigger sturdy ones are best)
1. Remove the Uconnect bezel. Open lower door (not part of bezel). pull bottom of bezel (not door) until clips release. 1/4 to 1/2 inch gap only. Work your way around with trim removal tool. Do top last. All clips must be released. Disconnect wire harness and set aside bezel. Use brute force at your own risk, safer to use the trim tool to release all clips.
2. Undo the four 7mm bolts to realease the Uconnect radio. Do not drop the bolts. Store bolts in cup holder.
3. Put microfibre cloth on lower door to prevent scratches. Pull out radio, so you can see cables. Take photo (not really necessary, as cables are colour coded).
4. Release cables, push flat tab down and pull cable connector out (can use screw driver to push tab down)
5. Release the 52 pin harness (pull the locking handle up first (push in then pull up) [see big yellow arrow in photos] ), Photo of released 52 pin connector is with locking handle removed for easier access to pin holes, The locking handle can go on either way round, Set the Uconnect aside on a towel.
6. Use a thin but wide flathead screw driver to loosen the red locking plate from the 52 pin connector. Start at center of short sides and work all way round. Do not need to completely remove it from connector. (1/2 inch should do)
7. Install the female RCA video cable. Black into pin 25 first then Yellow into pin 24. The pins must go in the correct way. The flat side (uncrimped side) goes in along the center ridge (see picture with big red arrows). Push in untill you hear a click. I used a pin removal tool to push down on the pin from the top. These pins are very small (less than 1.5mm). This is the most important part to get right, so do not rush this step. I used needle nose pliers to hold the wire to correctly guide the pin into the right hole. Push the red locking plate back into place.
8. Use electrical tape to tape the RCA video cable to the main wire bundle. (prevents it from being pulled)
9. Connect the camera male connector to the female RCA connector, Use eletrical tape to tape the camera cable to the main wrie bundle.
10. Feed the camera cable to the passenger side and pull cable through into footwell.
11. Reinstall Uconnect. When reinstalling 52 pin connector make sure locking handle is up for easy install.
12. Use alfaOBD to select "VehConfig 1-CHMSL Camera" present. (This step can be done before)
13. Lucky 13 - Before routing cable to engine bay, test that your CargoCam setup actually works. Connect camera and temp power source. Also check everything else works (did you forget to reattach a cable to the Uconnect).
14. If all is good. Route camera cable to engine bay via passenger side grommet, then cross over to driver/fusebox side in engine bay. On my 2015 JGC Summit all grommets are already fully used. Remove footwell side plastic trim then remove soft trim below glove box, you should now have access to firewall grommet.
15. Install front camera and route wire as close to fusebox as it will go. The front grill holes are large so I used M8 x 30mm stainless steel washers, https://www.amazon.co.uk/dp/B0BJZ2W6CH
16. Route and connect initial cable to front camera cable near fusebox.
17. Drill hole in back of fusebox, install rubber grommet (this is for the camera power wire)
18. Install micro 2 fuse tap with 5amp fuse (I used fuse F40 -Daytime running lights), connect positive wire to fuse tap.
19. Connect negative wire (My car had a bolt near the fusebox)
20. Test and Adjust your camera position. (still need to adjust camera on mine)
21. Reinstall the Uconnect bezel, remember to reconnect the wire harness first.
All done.
The CargoCam screen has 2 icons on the left top of the screen, these select CargoCam (front camera) or standard reverse camera.
Also when you engage reverse gear the standard reverse camera comes on, but also has 2 icons so you can select CargoCam while reversing.
CargoCam will stay on until you reach a speed of 10 mph.
You can also add a camera on pins 21/22. On alfaOBD select "ECUConfig 3-DTV front camera" or "ECUConfig 3-DTV side camera". In addition to the CargoCam icon you will also see an additional normal camera icon. However, I do not know how the DTV camera behaves (i.e. does it stay on while driving?)
It is relatively easy to identify the required pin holes since pin holes 21 thru 26 are empty (no wires in them)
SAVE MONEY make your own cable, this is the correct terminal pin:
UK: https://www.digikey.co.uk/en/products/detail/te-connectivity-amp-connectors/638551-3/10478563
USA: https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/638551-3/10478563
( Multiple countries - Select USA link on this page then Press on flag to select your country - then Select USA link on this page again )
Rca Male/Female Audio Cable Av Single-head Video Stereo Connect Extension Wire | eBay
1PCS Cable RCA female or male for choose.www.ebay.co.uk3Just adding a DisableDRM file does not actually enable the Wifi App, you need to enable it first - this is just to bypass DRM checks... which are only valid on older firmware now days.. you will need to hack SWF files to ignore DRM checks now days.
---------- Post added at 02:07 PM ---------- Previous post was at 02:06 PM ----------
YES many Thanks Leighm0, the Wifi button is activ!
But... which swf needs to be changed to disable the DRM?
Edit:
now i have the wifi button , but no gps signal!
my oiginal /dev/fram/productid "VP4_EU_MY14_REVA_N_D_N" to change "VP4_EU_MY14_REVA_E_D_N" After Change, no GPS Signal.
itś not an easy job
Here are my hacks, i cant remember which one got the Ecell GPS disabled (to use the normal GPS.. possibly the last one lol). These need to be executed when car is running, which i do from booter.lua which i get called from a modified media.sh on bootup. I believe i also use flexgps_ndr.sh to allow GPS.. cant recall what i modified in the file, dont have the original on hand to compare.
Code:os.execute("touch /fs/etfs/DISABLE_SPEED_LOCKOUT") os.execute("touch /fs/etfs/NAV_SECRETS") os.execute("touch /fs/etfs/enableEngMenu") os.execute("touch /fs/etfs/enableDlrMenu") os.execute("touch /fs/etfs/enableDealerMenu") os.execute("touch /fs/etfs/disableDRM") os.execute("touch /fs/etfs/disable_DRM") os.execute("touch /fs/etfs/disable_SpeedLockout") os.execute("touch /fs/etfs/useWLAN4QXDM") os.execute("touch /tmp/networkingpossible") os.execute("touch /tmp/ECELL_GPS_DISABLED")
Here is a link to all the files ive modified and uploaded to my head unit, they are for v16.13.13 MY14 car, suggest you either use them on the exact same firmware version, or decompile and compare to your firmwares SWF files and modify on your specific firmware.
https://mega.nz/#!9gkQhTiR!6anymlEx7ik2zl-Df_Rg3_ls70PgxQOy2JjpDodcBJk
I've also included all my hacked .sh and .lua files i run on the unit, and a "script.lua" which i use on the firmware update hack to push files to and from the unit, i have commented out all the commands - i usually just uncomment the ones i need to run off the usb upgrade, then go put it in my car and run it..
Enjoy.
---------- Post added at 07:04 AM ---------- Previous post was at 07:03 AM ----------
attached file above should help you out. Yes I run 2017 iGO maps with valid license on my car.. just need to get the license and map files..2huh i thought there would be more interest? i mean this could be the key to getting rid of the crappy uconnect software and run android.
Android has already been made to run on the same SoC TI DM3730 here http://elinux.org/Android_on_OMAP
