Golf MK7 Discover Pro Hack possible?

Search This thread
By:
Advanced…
L

lionheartk

Senior Member
Dec 11, 2008
307
1,048
Hello everyone, hope I'm posting in the right place!

I own a VW Golf MK7 with the Discover Pro media system.

Recently I found a copy of the update package for it, and dabbling inside I found out a ton of cool info.

It's based ona Tegra 2 platform, and runs QNX 1.2b. There seems to be a way to telnet to the system somehow. Inside the files I found a ton of stuff, like what seems to be the user and root passwords?

Code: 
root:x:0:0::/root/:/bin/sh
user:x:100:100::/eso:/bin/sh
nopasswd root::0:0::/root/:/bin/sh
user::100:100:FTP User:/eso:/bin/sh
group root:x:0:
user:x:100:user
root:f7otIPwQDbHLw:1320853303:0:0
user:6TfLBY3WGivFU:1324310912:0:0
ffs3.1ver #DATUM 2037

I don't know much about QNX, maybe someone can help and something can be done? Unlocking Mirrorlink? Unlocking other features? Installing apps? Installing android on it since it's Tegra 2 Based?

Thanks for the time and help!
 
  • Like
Reactions: mirhl and Sage
L

lionheartk

Senior Member
Dec 11, 2008
307
1,048
I made some progress, I was able to extract files from the .ifs partitions and from the app.img partition, which is the largest 700mb one.

Seems that the entire google maps and google earth, plus street view, are all there waiting to be enabled for those who don't have it. Also, there is a browser, and a lot of other apps.

I also discovered a possible vector of entrance:

Code: 
[SWDL_MEDIUM]
Callout     =  FNAME_MATCH
Argument    =  /metainfo2.txt
Match Rule  =  MediumInserted
Fail Rule   =  SW_UPDATE

[SW_UPDATE]
Callout     =  FNAME_MATCH
Argument    =  /mib_flashall
Match Rule  =  MediumInserted
Fail Rule   =  IOC_UPDATE

[IOC_UPDATE]
Callout     =  FNAME_MATCH
Argument    =  /V850app.bin
Match Rule  =  MediumInserted
Fail Rule   =  COPY_SCRIPT

[COPY_SCRIPT]
Callout     =  FNAME_MATCH
Argument    =  /copie_scr.sh
Match Rule  =  MediumInserted
Fail Rule   =  MIXED_DATA

I guess that's the name of the file it looks for on the SD and what action it takes based on what file it finds.

I could really use some QNX or even linux experts on this....
 
  • Like
Reactions: Sage
C

Chillout

Senior Member
Jul 15, 2008
243
176
Sorry for the late reply... but you inspired me some time ago to start digging into this.

I've built a serial cable to connect into the back of the Discover Pro MIB1 unit, and now I've got root access to the unit. So far I haven't been able to enable SWAP features, but I did make some changes to the Green Engineering Menu, that allow me to set stuff and run scripts from SD again.

I also enabled WLAN hotspot on the Non-telephone-capable unit, but I haven't been able to put it into WLAN Client mode yet... that's another hurdle for an other time, I guess. Enabling wlan unhides the Google Earth and online services checkboxes in the navigation, but since it doesn't have any connection yet... it doesn't do much.


I would love to exchange thoughts and experiences about this device!!
 
Last edited:
  • Like
Reactions: mirhl and Sage
M

mm2knet

New member
Jun 14, 2010
2
1
My Discover Pro is broken (right channels don't work anymore) and there will be no support from VW, so I am up to play around with the unit.
@Chillout: Did you connect your terminal cable to the PCI-E like looking connectors? Which voltage do you need?
 
  • Like
Reactions: Sage
R

radux.m.dan

Senior Member
Jun 18, 2014
53
7
Hi!

Nice to see some interest here.

The PCIe style connectors are for JTAG and flashing for MMX/ Jacinto 5/ V850 cpus.
The serial consoles are on the back side of the unit on the big black connector (quadlock)

The serial is normal 115200 8 bit mode.
See the picture attached, you will need to connect on ESO_C3_RX and ESO_C3_TX for MMX
For Jacinto 5 you should use the J5_TX and J5_RX
password for emergency console is harman_f
@lionheartk How do you extract / mount app.img file?
Cheers!
 
Last edited:
  • Like
Reactions: Sage
H

horacos

Member
Nov 21, 2016
5
1
Discover Media console

Hi!

By any chance do you know how it is working in a T6 MIB2 Discover Media (not pro) unit (made by Technisat)? Are the pinouts the same? And do you know the password for the emergency console for this as well?


radux.m.dan said:
Hi!

Nice to see some interest here.

The PCIe style connectors are for JTAG and flashing for MMX/ Jacinto 5/ V850 cpus.
The serial consoles are on the back side of the unit on the big black connector (quadlock)

The serial is normal 115200 8 bit mode.
See the picture attached, you will need to connect on ESO_C3_RX and ESO_C3_TX for MMX
For Jacinto 5 you should use the J5_TX and J5_RX
password for emergency console is harman_f

@lionheartk How do you extract / mount app.img file?
Cheers!
Click to expand...
Click to collapse
 
Last edited:
R

radux.m.dan

Senior Member
Jun 18, 2014
53
7
horacos said:
Hi!

By any chance do you know how it is working in a T6 MIB2 Discover Media (not pro) unit (made by Technisat)? Are the pinouts the same? And do you know the password for the emergency console for this as well?
Click to expand...
Click to collapse

Hi!

The MIB2 made by Technisat is completely different from software point of view. You need to figure out the UART pins, I don't think they are the same.
 
H

horacos

Member
Nov 21, 2016
5
1
Fine, many thanks for sharing this! I'd like to play with my unit, but I think blindly checking the pins by connecting them to a uart port are not a good idea :) Do you have any hint on how should I start? What kind of software/hardware it is based on?
 
R

radux.m.dan

Senior Member
Jun 18, 2014
53
7
Hi!
You will need to open the unit and take a look on the PCB.
The unit is build around a iMX6 for HMI and Jacinto 5 for radio control. The operating system is still QNX
If you post some pictures with PCB I might be able to give you some hint.
 
H

horacos

Member
Nov 21, 2016
5
1
radux.m.dan said:
Hi!
You will need to open the unit and take a look on the PCB.
The unit is build around a iMX6 for HMI and Jacinto 5 for radio control. The operating system is still QNX
If you post some pictures with PCB I might be able to give you some hint.
Click to expand...
Click to collapse

For first I'd like to avoid opening the unit, so I rather tried to use the pins marked as J5_TX, J5_RX and GND on your attached pic to hook to a serial port-usb cable. I've opened a terminal configured to 115200, 8N1, and below is a sample what I've got from it:

Code: 
úçůąÁ˙˙ůíŃ÷˙ýýž
               ˙˙ď^ąÁ˙˙ůíŃ÷˙ýý˝
                               ˙ńóÍ}úçůąÁ˙˙ůíŃ÷˙ýý|0lp˙˙˙^ąż˙˙ůíŃ÷˙ýýžűű˙˙^ąż˙˙ůíŃ÷˙ýýßąż˙3ż=żIc!żżżEżW[}yušem{_]AWYwA_Q[yAAuU[ëž_űűĺ˙|?˙˙˙ß˙˙ż˝ĐţůíŃ÷˙ý˙×ţý˙˙˙˙í˙˙˙˙˙˙˙˙˙ý˙˙˙ý˙˙˙˙˙˙˙˙˙˙˙˙˙ł˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ďýű˙ű˙?U_âń˙{ěď˙űö÷˙ú÷Uc˙|oc˙˙úń˝˙c˙˙í÷úń˝˙c˙˙Ď˙|oc˙˙ËÁ|oc˙˙ëőú÷a˝úí˙űv˙˙úóó˙ýúóu˙ýúí×I?Űoů!˙˙˙
9öÝS{Ď˙Ďé
         *÷öÝM˝ż˙˙˙˙˙˙˙˙ý˙xúíöÝłżž˙˙˙˙˙˙˙ýxöÝM˝ż˙˙˙˙˙˙˙˙ýxöÝfż˙˙{˙˙˙˙˙˙ýxöÝąó˙˙˙xöÝ_ĹUý˙˙˙˙˙˙˙˙ý        xö"ýxöÝcşýműąß˙˙˙˙˙ýxöÝÝ{ëďëá˙˙ű˙á˙ż÷Ňł˙ń?˙˙˙˙˙˙˙űűá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űůá˙ż÷Ň˙˙˙˙˙˙˙˙˙űőá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űńá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űďá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űëá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űçá˙ż÷Ň˙˙˙˙˙˙˙˙˙űăá˙ż÷Ň˙˙˙˙˙˙˙˙˙űáá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űÝá˙ż÷Ň˙˙˙˙˙˙˙˙˙űŮá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ű×ᯜÓőIoÝśŃ×I?o˙ßÍó;<eOńöß˙˙˙˙˙˙˙˙˙űÍß˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űÉá|gżÜ_˘6řú×űĹ×I?e˙˙Ýďýű˙˙˙˙ű÷öÝmş{Č/~˙˙˙˙űöÝŮ×˙˙˙˙˙˙˙˙˙˙űxöÝÝ[ëëëá˙˙űxöÝsś˙˙˙˙˙˙˙űxöÝ~âţ˙˙˙˙˙ů˙§˙űxöÝßâţ˙˙˙˙˙űó?űxöÝßâţ˙˙˙˙˙ů˙§˙űxöÝ~bo˙ýßĹ˙űxöÝßbo˙ýßĹ˙űxöÝ´şß_7ů˙˙˙˙˙ű}xöÝéďýąý˙ÝűűyxöÝM~l˙˙˙˙˙˙˙˙űwxö˙˙ýż˙ż÷Oţ˙˙˙˙˙÷ý§˙űoxöÝßâţ˙˙˙˙˙÷ý§˙űkxöÝMžű˙˙˙˙˙˙˙˙űixö˙˙ýżF˙ż÷2ą˙˙˙˙˙˙˙˙˙˙˙űaxöÝM˝ż˙˙˙˙˙˙˙˙ű_xöÝ˝żîoÝU]őU˙˙˙ű[xöÝŰĎUUKU˙ů˙˙˙˙űWxöÝśżneU˙ů˙˙˙űSxöÝlżnďăă]÷öÝßâţ˙˙˙˙ýŰă˙űxöÝ~âţ˙˙˙˙ýŮ÷˙ů˙á˙ż÷rOţ˙˙˙˙ýŮ÷˙ůűá˙ż÷ŇUľů˙˙˙˙˙˙˙˙ůůá˙ż÷Oţ˙˙˙˙ý×ů˙ůőá˙ż÷rOţ˙˙˙˙ý×ů˙ůńá˙ż÷Oţ˙˙˙˙ýŐé˙ůíá˙ż÷rOţ˙˙˙˙ýŐé˙ůëá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůçá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůăá˙ż÷ňM_ű˙˙˙˙˙˙˙˙ůáá˙ż÷ŇM˙˙ý~wxöÝMşű˙˙˙˙˙˙˙˙ůŮá˙ż÷˛M˙˙ý˙˙˙˙˙ůýůŐá˙ż÷Oţ˙˙˙˙ýÓé˙ůÓá˙ż÷rOţ˙˙˙˙ýÓé˙ůĎá˙ż÷rŰ˝UUKU˙ů˙˙˙˙ůËá˙ż÷2Ű˝ŤŞ]˙ů˙˙˙ůÉá˙ż÷ňŰ˝UUUŐż˙ůĹá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůÁá˙ż÷Ň˙˙˙˙˙˙˙˙˙ů˝á˙ż÷ňYű×˙~ˇ˙ż÷ňY~˙~[˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůłá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙ůąá˙ż÷ňYž˙˙~kxöż˙˙˙˙˙˙˙˙˙ůŠá˙ż÷ňY}˙˙~ixöż˙˙˙˙˙˙˙˙˙ůŁá˙ż÷ňYß˙˙á˙ż÷ňYźď˙˙˙ýýýý˙ůá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůá˙ż÷Oţ˙˙˙˙ýŃé˙ůá˙ż÷Oţ˙˙˙˙ýĹŰ˙áŻ{őIoÝ{×I?o˙ßÍó;<ŮĎńöÝ}âţ˙˙˙˙˙ő˙Ż˙ůwß˙ż÷rOţ˙˙˙˙ýŃé˙ůsá˙ż÷rOţ˙˙˙˙ýĹŰ˙ůoá˙ż÷2Oţ˙˙˙˙˙ő˙Ż˙ůká˙ż÷2÷Ďńů˙˙˙˙˙ůiá˙ż÷ňďýů˙˙˙˙ůeá˙ż÷2÷Íďů˙˙˙˙˙ůaá˙ż÷ňďý˙˙˙˙˙ů_á˙ż÷2÷Ëíů˙˙˙˙˙ů[á˙ż÷ň_˙˙˙˙˙ůWá˙ż÷Oţ˙˙˙˙ýĂ7˙ůSá˙ż÷rOţ˙˙˙˙ýĂ7˙ůQá˙ż÷Oţ˙˙˙˙ýÁ7˙ůMá˙ż÷ROţ˙˙˙˙ýĹŰ˙ůIá˙ż÷rOţ˙˙˙˙ýÁ7˙ůGá˙ż÷2Oţ˙˙˙˙ýĹŰ˙ůCá˙ż÷ňł˙˙˙˙˙˙˙˙˙˙˙ů?á˙ż÷Oţ˙˙˙˙ýż5˙ů;á˙ż÷rOţ˙˙˙˙ýż5˙ů9á˙ż÷Oţ˙˙˙˙˙7˙š˙ů5á˙ż÷rOţ˙˙˙˙˙7˙šőů1á˙ż÷2÷Éëů˙˙˙˙˙ů/á˙ż÷ňďýý˙˙˙˙ů+á˙ż÷O~\˙˙˙oĂ˙ů'á˙ż÷rO~\˙˙˙oĂ˙ů#á˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ů!á˙ż÷2÷Çéů˙˙˙˙˙ůá˙ż÷ňďýű˙˙˙˙ůá˙ż÷O~\˙˙˙kÓ˙ůá˙ż÷rO~\˙˙˙kÓ˙ůá˙ż÷O~\˙˙˙=ůá˙ż÷rO~\˙˙˙=ů
                                            á˙ż÷Oţ˙˙˙˙˙5˙Ű˙ů    á˙ż÷rOţ˙˙˙˙˙5˙Ű˙ůá˙ż÷r˙˙˙˙˙˙˙˙˙˙˙ůá˙ż÷2Ű*ŤŞ]˙Uő˙˙˙ůýxöÝ~âţ˙˙˙˙˙3őůűxöÝ~âţ˙˙˙˙˙1ýŻů÷xöÝßâţ˙˙˙˙˙3őůóxöÝ~âţ˙˙˙˙˙/˙˙ůńxöÝßâţ˙˙˙˙˙1ýŻ}~;xöÝ~âţ˙˙˙˙˙-ý×ůéxöÝ~âţ˙˙˙˙˙+ű?˙ůĺxöÝ~âţ˙˙˙˙˙)˙żůăxöÝ~"Çý˙˙˙]ůßxöÝßâţ˙˙˙˙˙/˙˙ůŰxöÝ~âţ˙˙˙˙˙%˙É˙ůŮxöÝßâţ˙˙˙˙˙-ý×ůŐxöÝ~âţ˙˙˙˙ý˝÷˙ůŃxöÝßâţ˙˙˙˙˙+ű?őůÍxöÝ~âţ˙˙˙˙˙#÷˙˙ůËxöÝßâţ˙˙˙˙˙)˙żůÇxúŰ˙ůŻ÷öÝßâţ˙˙˙˙˙%˙É˙ůŤxöÝ~âţ˙˙˙˙˙ýůŠxöÝßâţ˙˙˙˙ý˝÷˙ůĽxúďőůxöÝßâţ˙˙˙˙˙ý}~H˙ż÷rOţ˙˙˙˙˙˙őů
xöÝßâţ˙˙˙˙ýíőůxöÝߢ˙-˙Ő˙ů}xöż˙˙˙˙˙˙˙˙˙ůyxöÝY}˙˙~G˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůsxöż˙˙˙˙˙˙˙˙˙ůoxöż˙˙˙˙˙˙˙˙˙ůmxöÝ´żőő×ůM]˘J˙ń˙˙˙˙őŐőł÷ÁöÝ_˙˙˙˙˙ůI÷öÝ´şßß
                                                        ů˙˙˙˙˙ůExöÝéďý˛oÝűůCxöÝ´şß_űů˙˙˙˙˙ů?xöÝďýý˙˙˙˙ů;xöÝ´şßßëů˙˙˙˙˙ů7xöÝďýű˙˙˙˙ů5xöÝ´şß_Űů˙˙˙˙˙ů1xöÝéď˙ýůoŰűů-xúď˙÷˙˙˙˙÷)˙ż÷ˇIŃń˙˙˙˙˙÷)˙ż÷ňűIŃ˙˙˙˙˙˙˙˙÷'öÝcşý§ç˙˙˙˙˙˙˙÷˙ż÷ŇÓ÷ý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓűý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓýýĽů˙˙˙˙˙˙˙÷˙ż÷Rą/~!˙˙˙˙˙÷˙ż÷r6×˙˙˙˙˙˙˙˙˙˙÷˙ż÷ý˙˙˙˙˙˙˙˙˙÷˙ż÷ŇÓőý§˙˙˙˙˙˙˙˙őý˙ťVű˙Iiř˙˙ç˙˙˙ď÷őŮÝVű˙I?ińŠ˙˙˙˙óßőľ÷
                                                öÝcş_Ľ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓűýĽ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓýýŁů˙˙˙˙˙˙˙ő÷˙˙ż÷6÷Ľý˙˙˙˙

I've tried with other speeds (less than 115200), but the result is similar. Maybe it is sending an inverted tx signal?
 
H

horacos

Member
Nov 21, 2016
5
1
FInally serial output

Hi All,

Now i've tried to connect to port ESO C3_TX and RX, and finally i was able to see some understandable output (See below)
But do you know how shoudl I access any shell on it? I tought it provides a prompt to enter the password, but it doesn't. it rather seems to be a one direction logging console.
Any idea?

Thanks!

Code: 
J5e.imx6.start: 0x01CCEB6D


-Welcome to TechniBoot-
SVN Rev: 490082
J5e.M30.LoadImage.ready: 0x03EE913A
J5e.M31.LoadImage.ready: 0x04CBAAAC
J5e.QNX.LoadImage.ready: 0x1D5A82BD
CPU0: L1 Icache: 512x64
CPU0: L1 Dcache: 512x64 WB
CPU0: L2 Dcache: 4096x64 WB
CPU0: VFP-d32 FPSID=410330c3
CPU0: NEON MVFR0=11110222 MVFR1=00011111
CPU0: 413fc082: Cortex A8 rev 2 600MHz NOALIGN
Loading IFS...done

System page at phys:83fe0000 user:fc404000 kern:fc404000
Starting next program at vfe05145c
cpu_startnext: cpu0 -> fe05145c
VFPv3: fpsid=410330c3
coproc_attach(10): replacing fe0815b0 with fe080d6c
coproc_attach(11): replacing fe0815b0 with fe080d6c
Welcome to QNX Neutrino on the Texas Instruments J5 ECO MIBSTD2NAV_MAIN Board (ARMv7 Cortex-A8 Core)
J5e.QNX.init.ready
Waiting for i.MX...
Thu Jan 01 00:01:00 UTC 1970
add net default: gateway 10.200.1.2
Starting tsd.mibstd2.main.root...
Current core file directory: /tsd/var/core/startup-1/main
00:01:00.926     [Info] [J5e.mcp]       [FREQ:20000000]
00:01:00.929     [Info] [J5e.mcp]       [PERF:0x16a0592:IO1] J5e.MCP.init.start
Start Com-Client (MAINROOT)
Start Com2M30
shm mapped to 28010000
Start Network
Create Thread
00:01:00.998    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8100f09
00:01:01.004    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051a
00:01:01.005    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051b
00:01:01.005    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051c
00:01:01.006    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051d
00:01:01.007    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051e
00:01:01.007    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051f
00:01:01.008    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0520
00:01:01.008    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0521
00:01:01.009    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0556
00:01:01.009    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0556
00:01:01.025    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x70a0067
00:01:01.026    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x70a0068
shm mapped to 28020008
00:00:00.018    [Error] [J5e.cmsg.m30]  persist: (p1:p2) configuration failed status (p3). p1: 0 p2: 0 p3: 8
00:00:00.018     [Info] [J5e.mcp]       Booting at Normal Mode (0, 1)...
00:00:00.053    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8100002
00:00:00.055     [Info] [J5e.mcp]       [PERF:0x19d5536:IO0] J5e.MCP.init.ready
00:00:00.089     [Info] [J5e.mcp]       [PERF:0x1a7c8b2:IO0] J5e.PersMaster.start
00:00:00.114     [Info] [J5e.mcp]       [PERF:0x1af6181:IO0] J5e.Police.start
00:00:00.223     [Info] [J5e.mcp]       [PERF:0x1d0b969:IO0] J5e.Bap.start
00:00:00.262     [Info] [J5e.mcp]       [PERF:0x1dc6331:IO0] J5e.DSPStarter.start
dspstarter:
00:00:00.525     [Info] [J5e.mcp]       [PERF:0x22cabdd:IO0] J5e.DSPStarter.end
dspstarter:
00:00:00.568     [Info] [J5e.mcp]       [PERF:0x239d383:IO0] J5e.PersMaster.ready
00:00:00.585     [Info] [J5e.mcp]       [PERF:0x23f14fb:IO0] J5e.Keypanel.start
00:00:00.619     [Info] [J5e.mcp]       [PERF:0x2499719:IO0] J5e.Radio.start
00:00:01.152     [Info] [J5e.mcp]       [PERF:0x2ec1003:IO0] J5e.Keypanel.ready
bap: 00:00:01.166       [Error] [J5e.Bap.tsd.communication.serializer]  Serializer already registered for event 0x80e0006
00:00:01.176     [Info] [J5e.mcp]       [PERF:0x2f36f0d:IO0] J5e.Bap.ready
bap: 00:00:01.190       [Error] [J5e.Bap.bap.ref.parking]       000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
bap: 00:00:01.192       [Error] [J5e.Bap.bap.ref.parking]       000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
radio: 00:00:01.559     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x3002
radio: 00:00:01.563     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x40000bf
00:00:01.579     [Info] [J5e.mcp]       [PERF:0x36e4695:IO0] J5e.Radio.ready
radio: 00:00:01.632     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x14110001
00:00:01.717     [Info] [J5e.mcp]       [PERF:0x398a4d4:IO0] J5e.Police.ready
ListenServer: creating new worker thread
persmaster: 15:06:56.662        [Error] [J5e.PersMaster.tsd.common.watchdog]    WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998404847 endtime: 1481382416662
15:06:56.800     [Info] [J5e.mcp]       [PERF:0x8aefb6b:IO0] J5e.AudioMgr.start
bap: 15:06:56.880       [Error] [J5e.Bap.tsd.common.watchdog]   WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405050 endtime: 1481382416880
keypanel: 15:06:56.880  [Error] [J5e.Keypanel.tsd.common.watchdog]      WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405052 endtime: 1481382416880
police: 15:06:56.879    [Error] [J5e.Police.tsd.common.watchdog]        WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405032 endtime: 1481382416879
15:06:56.894    [Error] [J5e.tsd.common.watchdog]       WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405079 endtime: 1481382416894
audiomgr: Audio Manager started.
radio: 15:06:57.307     [Error] [J5e.Radio.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405492 endtime: 1481382417307
audiomgr: 15:06:57.499  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x8100003
audiomgr: 15:06:57.502  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307df
audiomgr: 15:06:57.526  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x8100003
audiomgr: 15:06:57.529  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307b2
audiomgr: 15:06:57.530  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307df
15:06:57.624     [Info] [J5e.mcp]       [PERF:0x9aa900b:IO0] J5e.AudioMgr.ready
15:07:03.052     [Info] [J5e.mcp]       [PERF:0x1022e899:IO0] J5e.Logging.start
bap: 15:07:10.831       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCCurrentConsumption1_local: unknown unit
bap: 15:07:10.833       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bap: 15:07:10.835       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
15:07:12.550     [Info] [J5e.mcp]       [PERF:0x1b756fa6:IO0] J5e.BapCar.start
15:07:13.225     [Info] [J5e.mcp]       [PERF:0x1c437c58:IO0] J5e.BapCar.ready
bapcar: 15:07:13.241    [Error] [J5e.BapCar.bap.ref.Klima]      000A13: (CarBAPCacheChanged): BAP-device (1) not yet enabled!
bapcar: 15:07:13.254    [Error] [J5e.BapCar.bap.ref.Klima]      000A13: (CarBAPCacheChanged): BAP-device (2) not yet enabled!
bap: 15:07:13.330       [Error] [J5e.Bap.tsd.mibstd2.hmi.dsi.cpp.DSICarKombi]   DSICarKombi::updateHUDColour: Dummy implementation called. Construction of service-provider-object not complete, HMI-Message lost.
bap: 15:07:13.333       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
bap: 15:07:13.335       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bapcar: 15:07:13.508    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
15:07:16.051     [Info] [J5e.mcp]       [PERF:0x1fa2030f:IO0] J5e.NwMgr.start
15:07:16.144     [Info] [J5e.mcp]       [PERF:0x1fbe3d21:IO0] J5e.NwMgr.ready
bapcar: 15:07:19.506    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
nwmgr: if_up: retries exhausted
nwmgr: ifconfig: SIOCGIFFLAGS ax0: No such device or address
15:07:21.072     [Info] [J5e.mcp]       [PERF:0x259e265d:IO0] J5e.SwDL.start
15:07:21.119     [Info] [J5e.mcp]       [PERF:0x25ac76d6:IO0] J5e.Debug.start
15:07:21.433     [Info] [J5e.mcp]       [PERF:0x260c719c:IO0] J5e.Debug.ready
bapcar: 15:07:25.510    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
bapcar: 15:07:31.511    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
 
  • Like
Reactions: salsa956
T

TTP

New member
May 10, 2010
3
0
I just started to collect Information about the MIB2 in Golf7. Here are some Informations that could be also usable:
forums. vwvortex .com / showthread.php?7159156-Discover-Pro-Hack-may-be-possible/page4

(sorry I´m not able to post full links)
 
C

Chillout

Senior Member
Jul 15, 2008
243
176
horacos said:
For first I'd like to avoid opening the unit, so I rather tried to use the pins marked as J5_TX, J5_RX and GND on your attached pic to hook to a serial port-usb cable. I've opened a terminal configured to 115200, 8N1, and below is a sample what I've got from it:

Code: 
úçůąÁ˙˙ůíŃ÷˙ýýž
               ˙˙ď^ąÁ˙˙ůíŃ÷˙ýý˝
                               ˙ńóÍ}úçůąÁ˙˙ůíŃ÷˙ýý|0lp˙˙˙^ąż˙˙ůíŃ÷˙ýýžűű˙˙^ąż˙˙ůíŃ÷˙ýýßąż˙3ż=żIc!żżżEżW[}yušem{_]AWYwA_Q[yAAuU[ëž_űűĺ˙|?˙˙˙ß˙˙ż˝ĐţůíŃ÷˙ý˙×ţý˙˙˙˙í˙˙˙˙˙˙˙˙˙ý˙˙˙ý˙˙˙˙˙˙˙˙˙˙˙˙˙ł˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ďýű˙ű˙?U_âń˙{ěď˙űö÷˙ú÷Uc˙|oc˙˙úń˝˙c˙˙í÷úń˝˙c˙˙Ď˙|oc˙˙ËÁ|oc˙˙ëőú÷a˝úí˙űv˙˙úóó˙ýúóu˙ýúí×I?Űoů!˙˙˙
9öÝS{Ď˙Ďé
         *÷öÝM˝ż˙˙˙˙˙˙˙˙ý˙xúíöÝłżž˙˙˙˙˙˙˙ýxöÝM˝ż˙˙˙˙˙˙˙˙ýxöÝfż˙˙{˙˙˙˙˙˙ýxöÝąó˙˙˙xöÝ_ĹUý˙˙˙˙˙˙˙˙ý        xö"ýxöÝcşýműąß˙˙˙˙˙ýxöÝÝ{ëďëá˙˙ű˙á˙ż÷Ňł˙ń?˙˙˙˙˙˙˙űűá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űůá˙ż÷Ň˙˙˙˙˙˙˙˙˙űőá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űńá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űďá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űëá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űçá˙ż÷Ň˙˙˙˙˙˙˙˙˙űăá˙ż÷Ň˙˙˙˙˙˙˙˙˙űáá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙űÝá˙ż÷Ň˙˙˙˙˙˙˙˙˙űŮá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ű×ᯜÓőIoÝśŃ×I?o˙ßÍó;<eOńöß˙˙˙˙˙˙˙˙˙űÍß˙ż÷ŇYß˙˙˙˙˙˙˙˙˙űÉá|gżÜ_˘6řú×űĹ×I?e˙˙Ýďýű˙˙˙˙ű÷öÝmş{Č/~˙˙˙˙űöÝŮ×˙˙˙˙˙˙˙˙˙˙űxöÝÝ[ëëëá˙˙űxöÝsś˙˙˙˙˙˙˙űxöÝ~âţ˙˙˙˙˙ů˙§˙űxöÝßâţ˙˙˙˙˙űó?űxöÝßâţ˙˙˙˙˙ů˙§˙űxöÝ~bo˙ýßĹ˙űxöÝßbo˙ýßĹ˙űxöÝ´şß_7ů˙˙˙˙˙ű}xöÝéďýąý˙ÝűűyxöÝM~l˙˙˙˙˙˙˙˙űwxö˙˙ýż˙ż÷Oţ˙˙˙˙˙÷ý§˙űoxöÝßâţ˙˙˙˙˙÷ý§˙űkxöÝMžű˙˙˙˙˙˙˙˙űixö˙˙ýżF˙ż÷2ą˙˙˙˙˙˙˙˙˙˙˙űaxöÝM˝ż˙˙˙˙˙˙˙˙ű_xöÝ˝żîoÝU]őU˙˙˙ű[xöÝŰĎUUKU˙ů˙˙˙˙űWxöÝśżneU˙ů˙˙˙űSxöÝlżnďăă]÷öÝßâţ˙˙˙˙ýŰă˙űxöÝ~âţ˙˙˙˙ýŮ÷˙ů˙á˙ż÷rOţ˙˙˙˙ýŮ÷˙ůűá˙ż÷ŇUľů˙˙˙˙˙˙˙˙ůůá˙ż÷Oţ˙˙˙˙ý×ů˙ůőá˙ż÷rOţ˙˙˙˙ý×ů˙ůńá˙ż÷Oţ˙˙˙˙ýŐé˙ůíá˙ż÷rOţ˙˙˙˙ýŐé˙ůëá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůçá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůăá˙ż÷ňM_ű˙˙˙˙˙˙˙˙ůáá˙ż÷ŇM˙˙ý~wxöÝMşű˙˙˙˙˙˙˙˙ůŮá˙ż÷˛M˙˙ý˙˙˙˙˙ůýůŐá˙ż÷Oţ˙˙˙˙ýÓé˙ůÓá˙ż÷rOţ˙˙˙˙ýÓé˙ůĎá˙ż÷rŰ˝UUKU˙ů˙˙˙˙ůËá˙ż÷2Ű˝ŤŞ]˙ů˙˙˙ůÉá˙ż÷ňŰ˝UUUŐż˙ůĹá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůÁá˙ż÷Ň˙˙˙˙˙˙˙˙˙ů˝á˙ż÷ňYű×˙~ˇ˙ż÷ňY~˙~[˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůłá˙ż÷ŇYß˙˙˙˙˙˙˙˙˙ůąá˙ż÷ňYž˙˙~kxöż˙˙˙˙˙˙˙˙˙ůŠá˙ż÷ňY}˙˙~ixöż˙˙˙˙˙˙˙˙˙ůŁá˙ż÷ňYß˙˙á˙ż÷ňYźď˙˙˙ýýýý˙ůá˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůá˙ż÷Oţ˙˙˙˙ýŃé˙ůá˙ż÷Oţ˙˙˙˙ýĹŰ˙áŻ{őIoÝ{×I?o˙ßÍó;<ŮĎńöÝ}âţ˙˙˙˙˙ő˙Ż˙ůwß˙ż÷rOţ˙˙˙˙ýŃé˙ůsá˙ż÷rOţ˙˙˙˙ýĹŰ˙ůoá˙ż÷2Oţ˙˙˙˙˙ő˙Ż˙ůká˙ż÷2÷Ďńů˙˙˙˙˙ůiá˙ż÷ňďýů˙˙˙˙ůeá˙ż÷2÷Íďů˙˙˙˙˙ůaá˙ż÷ňďý˙˙˙˙˙ů_á˙ż÷2÷Ëíů˙˙˙˙˙ů[á˙ż÷ň_˙˙˙˙˙ůWá˙ż÷Oţ˙˙˙˙ýĂ7˙ůSá˙ż÷rOţ˙˙˙˙ýĂ7˙ůQá˙ż÷Oţ˙˙˙˙ýÁ7˙ůMá˙ż÷ROţ˙˙˙˙ýĹŰ˙ůIá˙ż÷rOţ˙˙˙˙ýÁ7˙ůGá˙ż÷2Oţ˙˙˙˙ýĹŰ˙ůCá˙ż÷ňł˙˙˙˙˙˙˙˙˙˙˙ů?á˙ż÷Oţ˙˙˙˙ýż5˙ů;á˙ż÷rOţ˙˙˙˙ýż5˙ů9á˙ż÷Oţ˙˙˙˙˙7˙š˙ů5á˙ż÷rOţ˙˙˙˙˙7˙šőů1á˙ż÷2÷Éëů˙˙˙˙˙ů/á˙ż÷ňďýý˙˙˙˙ů+á˙ż÷O~\˙˙˙oĂ˙ů'á˙ż÷rO~\˙˙˙oĂ˙ů#á˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ů!á˙ż÷2÷Çéů˙˙˙˙˙ůá˙ż÷ňďýű˙˙˙˙ůá˙ż÷O~\˙˙˙kÓ˙ůá˙ż÷rO~\˙˙˙kÓ˙ůá˙ż÷O~\˙˙˙=ůá˙ż÷rO~\˙˙˙=ů
                                            á˙ż÷Oţ˙˙˙˙˙5˙Ű˙ů    á˙ż÷rOţ˙˙˙˙˙5˙Ű˙ůá˙ż÷r˙˙˙˙˙˙˙˙˙˙˙ůá˙ż÷2Ű*ŤŞ]˙Uő˙˙˙ůýxöÝ~âţ˙˙˙˙˙3őůűxöÝ~âţ˙˙˙˙˙1ýŻů÷xöÝßâţ˙˙˙˙˙3őůóxöÝ~âţ˙˙˙˙˙/˙˙ůńxöÝßâţ˙˙˙˙˙1ýŻ}~;xöÝ~âţ˙˙˙˙˙-ý×ůéxöÝ~âţ˙˙˙˙˙+ű?˙ůĺxöÝ~âţ˙˙˙˙˙)˙żůăxöÝ~"Çý˙˙˙]ůßxöÝßâţ˙˙˙˙˙/˙˙ůŰxöÝ~âţ˙˙˙˙˙%˙É˙ůŮxöÝßâţ˙˙˙˙˙-ý×ůŐxöÝ~âţ˙˙˙˙ý˝÷˙ůŃxöÝßâţ˙˙˙˙˙+ű?őůÍxöÝ~âţ˙˙˙˙˙#÷˙˙ůËxöÝßâţ˙˙˙˙˙)˙żůÇxúŰ˙ůŻ÷öÝßâţ˙˙˙˙˙%˙É˙ůŤxöÝ~âţ˙˙˙˙˙ýůŠxöÝßâţ˙˙˙˙ý˝÷˙ůĽxúďőůxöÝßâţ˙˙˙˙˙ý}~H˙ż÷rOţ˙˙˙˙˙˙őů
xöÝßâţ˙˙˙˙ýíőůxöÝߢ˙-˙Ő˙ů}xöż˙˙˙˙˙˙˙˙˙ůyxöÝY}˙˙~G˙ż÷ŇYż˙˙˙˙˙˙˙˙˙ůsxöż˙˙˙˙˙˙˙˙˙ůoxöż˙˙˙˙˙˙˙˙˙ůmxöÝ´żőő×ůM]˘J˙ń˙˙˙˙őŐőł÷ÁöÝ_˙˙˙˙˙ůI÷öÝ´şßß
                                                        ů˙˙˙˙˙ůExöÝéďý˛oÝűůCxöÝ´şß_űů˙˙˙˙˙ů?xöÝďýý˙˙˙˙ů;xöÝ´şßßëů˙˙˙˙˙ů7xöÝďýű˙˙˙˙ů5xöÝ´şß_Űů˙˙˙˙˙ů1xöÝéď˙ýůoŰűů-xúď˙÷˙˙˙˙÷)˙ż÷ˇIŃń˙˙˙˙˙÷)˙ż÷ňűIŃ˙˙˙˙˙˙˙˙÷'öÝcşý§ç˙˙˙˙˙˙˙÷˙ż÷ŇÓ÷ý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓűý§˙˙˙˙˙˙˙˙÷˙ż÷ŇÓýýĽů˙˙˙˙˙˙˙÷˙ż÷Rą/~!˙˙˙˙˙÷˙ż÷r6×˙˙˙˙˙˙˙˙˙˙÷˙ż÷ý˙˙˙˙˙˙˙˙˙÷˙ż÷ŇÓőý§˙˙˙˙˙˙˙˙őý˙ťVű˙Iiř˙˙ç˙˙˙ď÷őŮÝVű˙I?ińŠ˙˙˙˙óßőľ÷
                                                öÝcş_Ľ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓűýĽ˙˙˙˙˙˙˙˙őů˙˙ż÷ŇÓýýŁů˙˙˙˙˙˙˙ő÷˙˙ż÷6÷Ľý˙˙˙˙

I've tried with other speeds (less than 115200), but the result is similar. Maybe it is sending an inverted tx signal?
Click to expand...
Click to collapse
Make sure it is at 115200 speed, xon/xoff flow control.

I got pretty far with the mib1, currently playing with the mib2. This can be accessed pretty easily, just put it in wifi client mode and then you'll have port 23 open for some telnet business!

---------- Post added at 03:00 PM ---------- Previous post was at 02:56 PM ----------
horacos said:
Hi All,

Now i've tried to connect to port ESO C3_TX and RX, and finally i was able to see some understandable output (See below)
But do you know how shoudl I access any shell on it? I tought it provides a prompt to enter the password, but it doesn't. it rather seems to be a one direction logging console.
Any idea?

Thanks!

Code: 
J5e.imx6.start: 0x01CCEB6D


-Welcome to TechniBoot-
SVN Rev: 490082
J5e.M30.LoadImage.ready: 0x03EE913A
J5e.M31.LoadImage.ready: 0x04CBAAAC
J5e.QNX.LoadImage.ready: 0x1D5A82BD
CPU0: L1 Icache: 512x64
CPU0: L1 Dcache: 512x64 WB
CPU0: L2 Dcache: 4096x64 WB
CPU0: VFP-d32 FPSID=410330c3
CPU0: NEON MVFR0=11110222 MVFR1=00011111
CPU0: 413fc082: Cortex A8 rev 2 600MHz NOALIGN
Loading IFS...done

System page at phys:83fe0000 user:fc404000 kern:fc404000
Starting next program at vfe05145c
cpu_startnext: cpu0 -> fe05145c
VFPv3: fpsid=410330c3
coproc_attach(10): replacing fe0815b0 with fe080d6c
coproc_attach(11): replacing fe0815b0 with fe080d6c
Welcome to QNX Neutrino on the Texas Instruments J5 ECO MIBSTD2NAV_MAIN Board (ARMv7 Cortex-A8 Core)
J5e.QNX.init.ready
Waiting for i.MX...
Thu Jan 01 00:01:00 UTC 1970
add net default: gateway 10.200.1.2
Starting tsd.mibstd2.main.root...
Current core file directory: /tsd/var/core/startup-1/main
00:01:00.926     [Info] [J5e.mcp]       [FREQ:20000000]
00:01:00.929     [Info] [J5e.mcp]       [PERF:0x16a0592:IO1] J5e.MCP.init.start
Start Com-Client (MAINROOT)
Start Com2M30
shm mapped to 28010000
Start Network
Create Thread
00:01:00.998    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8100f09
00:01:01.004    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051a
00:01:01.005    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051b
00:01:01.005    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051c
00:01:01.006    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051d
00:01:01.007    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051e
00:01:01.007    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff051f
00:01:01.008    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0520
00:01:01.008    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0521
00:01:01.009    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0556
00:01:01.009    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8ff0556
00:01:01.025    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x70a0067
00:01:01.026    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x70a0068
shm mapped to 28020008
00:00:00.018    [Error] [J5e.cmsg.m30]  persist: (p1:p2) configuration failed status (p3). p1: 0 p2: 0 p3: 8
00:00:00.018     [Info] [J5e.mcp]       Booting at Normal Mode (0, 1)...
00:00:00.053    [Error] [J5e.tsd.communication.serializer]      Serializer already registered for event 0x8100002
00:00:00.055     [Info] [J5e.mcp]       [PERF:0x19d5536:IO0] J5e.MCP.init.ready
00:00:00.089     [Info] [J5e.mcp]       [PERF:0x1a7c8b2:IO0] J5e.PersMaster.start
00:00:00.114     [Info] [J5e.mcp]       [PERF:0x1af6181:IO0] J5e.Police.start
00:00:00.223     [Info] [J5e.mcp]       [PERF:0x1d0b969:IO0] J5e.Bap.start
00:00:00.262     [Info] [J5e.mcp]       [PERF:0x1dc6331:IO0] J5e.DSPStarter.start
dspstarter:
00:00:00.525     [Info] [J5e.mcp]       [PERF:0x22cabdd:IO0] J5e.DSPStarter.end
dspstarter:
00:00:00.568     [Info] [J5e.mcp]       [PERF:0x239d383:IO0] J5e.PersMaster.ready
00:00:00.585     [Info] [J5e.mcp]       [PERF:0x23f14fb:IO0] J5e.Keypanel.start
00:00:00.619     [Info] [J5e.mcp]       [PERF:0x2499719:IO0] J5e.Radio.start
00:00:01.152     [Info] [J5e.mcp]       [PERF:0x2ec1003:IO0] J5e.Keypanel.ready
bap: 00:00:01.166       [Error] [J5e.Bap.tsd.communication.serializer]  Serializer already registered for event 0x80e0006
00:00:01.176     [Info] [J5e.mcp]       [PERF:0x2f36f0d:IO0] J5e.Bap.ready
bap: 00:00:01.190       [Error] [J5e.Bap.bap.ref.parking]       000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
bap: 00:00:01.192       [Error] [J5e.Bap.bap.ref.parking]       000A13: (CarBAPCacheChanged): BAP-device (11) not yet enabled!
radio: 00:00:01.559     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x3002
radio: 00:00:01.563     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x40000bf
00:00:01.579     [Info] [J5e.mcp]       [PERF:0x36e4695:IO0] J5e.Radio.ready
radio: 00:00:01.632     [Error] [J5e.Radio.tsd.communication.serializer]        Serializer already registered for event 0x14110001
00:00:01.717     [Info] [J5e.mcp]       [PERF:0x398a4d4:IO0] J5e.Police.ready
ListenServer: creating new worker thread
persmaster: 15:06:56.662        [Error] [J5e.PersMaster.tsd.common.watchdog]    WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998404847 endtime: 1481382416662
15:06:56.800     [Info] [J5e.mcp]       [PERF:0x8aefb6b:IO0] J5e.AudioMgr.start
bap: 15:06:56.880       [Error] [J5e.Bap.tsd.common.watchdog]   WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405050 endtime: 1481382416880
keypanel: 15:06:56.880  [Error] [J5e.Keypanel.tsd.common.watchdog]      WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405052 endtime: 1481382416880
police: 15:06:56.879    [Error] [J5e.Police.tsd.common.watchdog]        WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405032 endtime: 1481382416879
15:06:56.894    [Error] [J5e.tsd.common.watchdog]       WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405079 endtime: 1481382416894
audiomgr: Audio Manager started.
radio: 15:06:57.307     [Error] [J5e.Radio.tsd.common.watchdog] WatchdogManager detected a semaphore sleep bigger than expired time  starttime: 1356998405492 endtime: 1481382417307
audiomgr: 15:06:57.499  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x8100003
audiomgr: 15:06:57.502  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307df
audiomgr: 15:06:57.526  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x8100003
audiomgr: 15:06:57.529  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307b2
audiomgr: 15:06:57.530  [Error] [J5e.AudioMgr.tsd.communication.serializer]     Serializer already registered for event 0x80307df
15:06:57.624     [Info] [J5e.mcp]       [PERF:0x9aa900b:IO0] J5e.AudioMgr.ready
15:07:03.052     [Info] [J5e.mcp]       [PERF:0x1022e899:IO0] J5e.Logging.start
bap: 15:07:10.831       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCCurrentConsumption1_local: unknown unit
bap: 15:07:10.833       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bap: 15:07:10.835       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
15:07:12.550     [Info] [J5e.mcp]       [PERF:0x1b756fa6:IO0] J5e.BapCar.start
15:07:13.225     [Info] [J5e.mcp]       [PERF:0x1c437c58:IO0] J5e.BapCar.ready
bapcar: 15:07:13.241    [Error] [J5e.BapCar.bap.ref.Klima]      000A13: (CarBAPCacheChanged): BAP-device (1) not yet enabled!
bapcar: 15:07:13.254    [Error] [J5e.BapCar.bap.ref.Klima]      000A13: (CarBAPCacheChanged): BAP-device (2) not yet enabled!
bap: 15:07:13.330       [Error] [J5e.Bap.tsd.mibstd2.hmi.dsi.cpp.DSICarKombi]   DSICarKombi::updateHUDColour: Dummy implementation called. Construction of service-provider-object not complete, HMI-Message lost.
bap: 15:07:13.333       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCLongAverageConsumption1_local: unknown unit
bap: 15:07:13.335       [Error] [J5e.Bap.tsd.mibstd2.carcom.bap.lsdcan.CarKombiDSIAdapter]      ImplementationLsgCAN::updateBCShortAverageConsumption1_local: unknown unit
bapcar: 15:07:13.508    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
15:07:16.051     [Info] [J5e.mcp]       [PERF:0x1fa2030f:IO0] J5e.NwMgr.start
15:07:16.144     [Info] [J5e.mcp]       [PERF:0x1fbe3d21:IO0] J5e.NwMgr.ready
bapcar: 15:07:19.506    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
nwmgr: if_up: retries exhausted
nwmgr: ifconfig: SIOCGIFFLAGS ax0: No such device or address
15:07:21.072     [Info] [J5e.mcp]       [PERF:0x259e265d:IO0] J5e.SwDL.start
15:07:21.119     [Info] [J5e.mcp]       [PERF:0x25ac76d6:IO0] J5e.Debug.start
15:07:21.433     [Info] [J5e.mcp]       [PERF:0x260c719c:IO0] J5e.Debug.ready
bapcar: 15:07:25.510    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
bapcar: 15:07:31.511    [Error] [J5e.BapCar.bap.ref.HomeLink]   019406: BAP-device (20) not yet enabled!
Click to expand...
Click to collapse
Hit enter a couple of times!
You'll see a login error soon enough.
Type stfu after login to be sure your screen isn't filled with data.
 
H

horacos

Member
Nov 21, 2016
5
1
Re-start

Appreciate your help Chillout! As I can recall I saw these kind of login error messages, but haven't seen any command prompt. So I think I need some work to do today evening once I get home :) I'll try, especially this very special command called "stfu" ;)
And how can I put the device in wifi client mode? Should I have the vag-com cable for that? Thanks again for the help!
 
C

Chillout

Senior Member
Jul 15, 2008
243
176
If you have an MIB2 (2nd generation) device, the Wifi client mode can be found under WLAN settings. There are two possibilities with this device:
- hotspot mode
- wlan client mode (although they don't call it wlan client in the menu's, it's the one that allows you to search for hotspots).

You don't need anything else besides a MIB2 and a hotspot.


I really had to laugh about STFU. It took some time before I found the command, while browsing through all the directories, and got curious what "stfu" would do. Before that, it was extremely frustrating to see all the data scrolling by whenever I wanted to see contents of a directory, or file. STFU is not needed when connecting over telnet, it's a serial access only thing.
 
O

offsystem

New member
May 18, 2017
3
0
Chillout said:
If you have an MIB2 (2nd generation) device, the Wifi client mode can be found under WLAN settings. There are two possibilities with this device:
- hotspot mode
- wlan client mode (although they don't call it wlan client in the menu's, it's the one that allows you to search for hotspots).

You don't need anything else besides a MIB2 and a hotspot.


I really had to laugh about STFU. It took some time before I found the command, while browsing through all the directories, and got curious what "stfu" would do. Before that, it was extremely frustrating to see all the data scrolling by whenever I wanted to see contents of a directory, or file. STFU is not needed when connecting over telnet, it's a serial access only thing.
Click to expand...
Click to collapse

Hi chillout!

When i am trying to connect via telnet i can't get connection to the unit.
i put in the IP which MIB2 shows me in the "Hidden Engineering menü"

thx
 
C

Chillout

Senior Member
Jul 15, 2008
243
176
offsystem said:
Hi chillout!

When i am trying to connect via telnet i can't get connection to the unit.
i put in the IP which MIB2 shows me in the "Hidden Engineering menü"

thx
Click to expand...
Click to collapse

When the unit is in wifi client mode, you should be able to connect to it, by using the IP it is using as an access point. If this doesn't work, get one of these devices, plug it in the USB port, and connect to IP: 172.16.250.248 (make sure to change your own IP to something in the same IP range, so something like 172.16.250.247). Port 23 should be available to you.


D-Link DUB-E100 (0x2001, 0x3c05)
D-Link DUB-E100 (0x2001, 0x1a02)
SMSC9500 (0x0424, 0x9500)
Germaneers LAN9514 (0x2721, 0xec00)
Cinterion AH6A 3G (0x1e2d, 0x0055)
Cinterion ALS1/ALS6 (0x1e2d, 0x0060)
 
Last edited:
  • Like
Reactions: offsystem
M

manos78

Senior Member
Jan 17, 2014
808
310
Hi,

Some questions:

1) This can be possible also with MIB2 "non-pro"?

2) To enable the TELNET access is required to enable the Green Manufacturer Menu?

3) The USB dongle has all the time the TELNET server enabled, or only when the Green Menu is enabled?

Thank you for sharing this info.
 
C

Chillout

Senior Member
Jul 15, 2008
243
176
manos78 said:
Hi,

Some questions:

1) This can be possible also with MIB2 "non-pro"?

2) To enable the TELNET access is required to enable the Green Manufacturer Menu?

3) The USB dongle has all the time the TELNET server enabled, or only when the Green Menu is enabled?

Thank you for sharing this info.
Click to expand...
Click to collapse

1: should be possible, just use one of the network adapters I mentioned
2: as far as I can tell, this is always on. But it doesn't hurt to enable developer mode
3: all the time.
 
  • Like
Reactions: Sage and manos78
You must log in or register to reply here.

Similar threads

Z
HACK Navigation/Multimedia systems KIA/HYUNDAI and install third-party applications
Replies
2K
Views
955K
L
loshabih
M
success to hack Technisat MIB2 infotainment system
Replies
344
Views
265K
bubuste
bubuste
C
hacking nac peugeot
Replies
108
Views
127K
Picard_XDA
Picard_XDA
B
TOYOTA ENTUNE plus and use of google maps app. possible?
Replies
10
Views
78K
T
Togrof
L
VW Golf mk7 (2012-2015) MIB1 mirrorlink
Replies
0
Views
6K
L
LC22

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 2
    L
    lionheartk
    Hello everyone, hope I'm posting in the right place!

    I own a VW Golf MK7 with the Discover Pro media system.

    Recently I found a copy of the update package for it, and dabbling inside I found out a ton of cool info.

    It's based ona Tegra 2 platform, and runs QNX 1.2b. There seems to be a way to telnet to the system somehow. Inside the files I found a ton of stuff, like what seems to be the user and root passwords?

    Code: 
    root:x:0:0::/root/:/bin/sh
user:x:100:100::/eso:/bin/sh
nopasswd root::0:0::/root/:/bin/sh
user::100:100:FTP User:/eso:/bin/sh
group root:x:0:
user:x:100:user
root:f7otIPwQDbHLw:1320853303:0:0
user:6TfLBY3WGivFU:1324310912:0:0
ffs3.1ver #DATUM 2037

    I don't know much about QNX, maybe someone can help and something can be done? Unlocking Mirrorlink? Unlocking other features? Installing apps? Installing android on it since it's Tegra 2 Based?

    Thanks for the time and help!
    View
    2
    C
    Chillout
    hrdinaveliky said:
    I found by root this text: daPzPBI8LXeWY could you help me with decrypt???
    Click to expand...
    Click to collapse
    You have a Skoda? ;)
    View
    2
    C
    Chillout
    Sorry for the late reply... but you inspired me some time ago to start digging into this.

    I've built a serial cable to connect into the back of the Discover Pro MIB1 unit, and now I've got root access to the unit. So far I haven't been able to enable SWAP features, but I did make some changes to the Green Engineering Menu, that allow me to set stuff and run scripts from SD again.

    I also enabled WLAN hotspot on the Non-telephone-capable unit, but I haven't been able to put it into WLAN Client mode yet... that's another hurdle for an other time, I guess. Enabling wlan unhides the Google Earth and online services checkboxes in the navigation, but since it doesn't have any connection yet... it doesn't do much.


    I would love to exchange thoughts and experiences about this device!!
    View
    2
    C
    Chillout
    Yes indeed.

    Open efs-system.img from the firmware files, search for root:
    If you find root:, you will see the password hash. This hash is 3des, and can be cracked. That will be your password.
    View
    2
    C
    Chillout
    manos78 said:
    Hi,

    Some questions:

    1) This can be possible also with MIB2 "non-pro"?

    2) To enable the TELNET access is required to enable the Green Manufacturer Menu?

    3) The USB dongle has all the time the TELNET server enabled, or only when the Green Menu is enabled?

    Thank you for sharing this info.
    Click to expand...
    Click to collapse

    1: should be possible, just use one of the network adapters I mentioned
    2: as far as I can tell, this is always on. But it doesn't hurt to enable developer mode
    3: all the time.
    View

New posts