2016 Honda Civic - Android-based Headunit - North American version

Search This thread
Jul 11, 2016
7
0
Hello all,
I've looked through a lot of information online, and am not able to find anything.
Here's the situation, as many of you probably know, the headunit in the 2016 Honda Civic, for all markets - is Android-based.
Another fact that some of you may not know, is that the headunit is the same for both navigation-equiped models (aka Touring) and non-navi models; all of the head-units have a built in GPS, however Honda seems to have disabled the/or not installed the app for Navigation (Garmin-based).
When you fire up the headunit, you have an "Apps" section, which includes the standard stuff - Gallery, calculator, etc, however you also have an "App Installer" app, which looks for APKs.
You can throw an APK onto any USB drive and it will pick it up, however, it will not install - when you select the APK, the installer will be grayed out.
On previous models, (model year 2015), you could get around this by renaming the APK, however that trick does not work on the 2016 North-American trim.

Does anyone know if any progress has been made into this, or how the unit has a "Whitelist" app pool? Perhaps a "package name" approach - i.e. com.honda.navigation - that's contained in some sort of global whitelist?

Any advice is greatly appreciated!
It really irks me when a manufacturer soft-locks features that are already built in, and doesn't even offer you the alternative to unlock them....
 

majedalanni

Senior Member
Jun 5, 2007
151
22
OnePlus 8
OnePlus 8 Pro
+1 I'm looking to thia too but couldn't find anything. All I get interesting is when you hold power+menu and the brightness bottom on the top will start mew menu and after you choose the bottom one you will have couple menues there and if you hold the menu again will get you another menu and if you hold it again will get you another one but couldn't find anything helpfull for apk
 
  • Like
Reactions: epic4grooted

djg08642

Member
Feb 7, 2008
16
1
Does anyone know the actual manufacture of that had unit

Sent from my Nexus 6 using Tapatalk

I was poking around via adb last night and found a few clues.

These are in /system/app:
Code:
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though :)

http://forum.xda-developers.com/showpost.php?p=66155158&postcount=82
 
Last edited:

epic4grooted

Senior Member
Sep 3, 2010
169
13
portland
what thread is that link to I couldn't get it to come up
I was poking around via adb last night and found a few clues.

These are in /system/app:
Code:
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though :)

http : // forum . xda-developers . com /showpost.php?p=66155158&postcount=82
 

djg08642

Member
Feb 7, 2008
16
1
http://www.clarion.com/us/en/user-support/oss-1/ I don't know if this can help in any way....

Sent from my Nexus 6P using Tapatalk

I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using
Code:
adb reboot bootloader
over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.
 

enyce9

Senior Member
Jun 26, 2008
255
39
I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using
Code:
adb reboot bootloader
over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.
I stumbled upon the boot mode as well but don't have the balls to try any of the options.

Sent from my Nexus 6P using Tapatalk
 

djg08642

Member
Feb 7, 2008
16
1
We need a dump of our system

Sent from my Nexus 6 using Tapatalk

That reminds me I also tried doing an `adb backup`. I accepted the prompt on the head unit and everything appeared to be running as expected but the process resulted in a 41 byte .ab backup file. They've really got these devices locked down.
 

epic4grooted

Senior Member
Sep 3, 2010
169
13
portland
I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using
Code:
adb reboot bootloader
over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.
Your connecting over wifi?

Sent from my Nexus 6 using Tapatalk
 

epic4grooted

Senior Member
Sep 3, 2010
169
13
portland
I'll mess around with it this week end I'm in school for Android development maybe I can put it to use lol

Sent from my Nexus 6 using Tapatalk
 
  • Like
Reactions: enyce9

enyce9

Senior Member
Jun 26, 2008
255
39
According to others in the honda pilot forum there is a hidden usb port in the back of the head unit..... It appears to be usb type B, like on a printer. I have yet to see a picture though.
I should note I own a 2017 ridgeline running 4.2.2.
Is it also safe to assume the only way to get a system dump is by rooting the head unit first?
Sent from my Nexus 6P using Tapatalk
 

josby

Member
Oct 21, 2006
11
2
Richmond, VA
I was poking around via adb last night and found a few clues.

These are in /system/app:
Code:
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though :)

http://forum.xda-developers.com/showpost.php?p=66155158&postcount=82

And that's a Civic, not a Pilot? I ask because Honda's parts listings show the Pilot HU being made by Clarion, but the NA Civic's made by Mitsubishi. I can connect to my Civic's with adb via wifi but not get it go online (see attached). I think that's because it's not in USB debug mode, because there's no way to turn on developer options, but you didn't seem to encounter any difficulties with that?
 

Attachments

  • Untitled.png
    Untitled.png
    27.5 KB · Views: 336

k3v1nc

Member
Jun 19, 2007
5
1
My 2016 Civic EX-L is has a unit made by Mitsubishi for sure. Clarion sounds like the Pilot to me.
Anyways, something I've been thinking about is trying to get my hands on the software update USB that is part of the TSB 16-022 (http://www.civicx.com/attachments/ml-reaasc6a-usb_drive_sb_16-022-pdf.10010/). The USB update has a honda part number of 07AAZ-TBAA100 and seems to be available from honda parts stores online. I can't find an disk image of it online. If it has a full copy of the OS file system, might be able to extract it and look for vulnerabilities. Or it might be possible to learn how to create a custom update USB. Clearly from the TSB instructions, the headunit recognizes it as a system update and presents a prompt that is different from anything I've seen on it before.
 
  • Like
Reactions: josby

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    SORRY FOR MY ENGLISH [​IMG]

    Finally I found a way to bypass the restriction method and play video while driving
    Anyone following these steps it total by his/her own risk and I'm not responsible to any issue might happen as I'm doing this for research purposes. for me it is working each time I'm doing it

    1. Push your ignite button twice so you not be in accessory mode
    2. Hold Bright power and menu until you see two choice click on the bottom one
    3. Hold menu key to get to another menu
    4. Choose vehicle model information then vehicle setting type and you will see three types
    TBAA:Gr013 DA KC No 4DR
    TBAA:Gr013 DA KA No 4DR (this is the default one in my car)
    TBAA:Gr013 DA Kx No 4DR

    You will need to choose
    TBAA:Gr013 DA KC No 4DR (you need to make sure you are in empty space area as the GPS need to be locked after rebooting and also make sure you are not in accessory mode)
    5. After the device reboot hold bright power and menu again and choose functional setup and then other
    6. You will see operation restricted turn it off
    7. Also enable Pandora and then back to home menu
    8. Now you have system that can be modified couple things while driving like you can use the dial pad
    9. Now phase two to watch videos
    10. Open the internet browser and type about:debug
    11. Then delete it and type file:/// and hit enter
    12. You will see the file system files, scroll down and click on vendor then app folder
    13. scroll down and you find whitelistservice apk file
    14. NEVER NEVER NEVER click on any APK only whitelistservice apk (I WARN YOU!!!!!!!!!!!!!!!!!!!)
    15. click on it and it will try to install then it fail
    16. then back to the home screen and hold power till it asking for reboot. reboot your system and viola you can run browser and gallery to browse , watch you tube or videos

    Might you need to turn off your lane camera as when ever you right signal it will stop your video

    issues you may get with this method
    App installer will not work
    rear camera very rare can be delayed or lag

    To revert the video thing then you need to setting then apps download section and you will see the white list service there then just uninstall it and you back to normal.. if it acting weird just reboot the unit


    Now to things I figured it out

    Any apk files that are android system files from version 4.2.2 it will fail with signature different from the one installed
    AHA APK can be update it will not working good as it not design for car ( I got it from internet)
    apklist.apk from Honda pilot it willing to install but it fail because the version that we have is newer (at least mine as it update to latest android version f190)
    Any app you click on it will show gray install button but if you multitask and go to the browser and browse the path /data/data/usbtmp then you will see the file there and that path can install apk but it will fail again. what ever you do the file will delete from there.. i tried to unplugged the fuse and the file stayed there so I tried the to do the whitelistservice.apk that we did above as this will stop the service from running but looks the package installer call whielistlib and the lib check the signature too.

    I tried to plug USB serial as I can see in the log android loading PL32XX driver and i change the USB from HOST to DEVICE from the hidden menu i got an Ethernet connection from the USB and I can see the internal sdcard not the system as it is MTP I think.

    Rebooting the device and holding menu will get you in safe mode but it didn't help anything

    Honda link when enabled it will open another port other than the 5000 (random) when you nmap for the HU IP

    Tried most exploits on browser didn't work

    Modified APK didn't working

    I would we all work together and break the APK installing process.

    Donate can accepted to by pizza and drink [​IMG] on paypal
    Majedalanni at yahoo.com

    Thanks guys for reading my post
    1
    +1 I'm looking to thia too but couldn't find anything. All I get interesting is when you hold power+menu and the brightness bottom on the top will start mew menu and after you choose the bottom one you will have couple menues there and if you hold the menu again will get you another menu and if you hold it again will get you another one but couldn't find anything helpfull for apk
    1
    I'll mess around with it this week end I'm in school for Android development maybe I can put it to use lol

    Sent from my Nexus 6 using Tapatalk
    1
    My 2016 Civic EX-L is has a unit made by Mitsubishi for sure. Clarion sounds like the Pilot to me.
    Anyways, something I've been thinking about is trying to get my hands on the software update USB that is part of the TSB 16-022 (http://www.civicx.com/attachments/ml-reaasc6a-usb_drive_sb_16-022-pdf.10010/). The USB update has a honda part number of 07AAZ-TBAA100 and seems to be available from honda parts stores online. I can't find an disk image of it online. If it has a full copy of the OS file system, might be able to extract it and look for vulnerabilities. Or it might be possible to learn how to create a custom update USB. Clearly from the TSB instructions, the headunit recognizes it as a system update and presents a prompt that is different from anything I've seen on it before.
    1
    And that's a Civic, not a Pilot? I ask because Honda's parts listings show the Pilot HU being made by Clarion, but the NA Civic's made by Mitsubishi. I can connect to my Civic's with adb via wifi but not get it go online (see attached). I think that's because it's not in USB debug mode, because there's no way to turn on developer options, but you didn't seem to encounter any difficulties with that?

    Sorry, this is actually in a 2016 Accord EX (w/ Sensing if that matters). I posted in this thread since the other lengthy thread, where they have things working, is for EU head units and this one appears to be the de facto NA thread.

    You can get into Developer Options to enable USB debugging. On my stereo, at least, with the car in Accessory Mode, I hold Power+Brightness+Menu to get the head unit's Diagnostic menu. Then hold Menu for about 3 seconds to get the Android settings. Developer Options and USB Debugging is in there.

    Here's a video showing how to get into the Android settings: https://vid.me/o4iZ