2016 Honda Civic - Android-based Headunit - North American version

[SergeiMedvedev]

Hello all,
I've looked through a lot of information online, and am not able to find anything.
Here's the situation, as many of you probably know, the headunit in the 2016 Honda Civic, for all markets - is Android-based.
Another fact that some of you may not know, is that the headunit is the same for both navigation-equiped models (aka Touring) and non-navi models; all of the head-units have a built in GPS, however Honda seems to have disabled the/or not installed the app for Navigation (Garmin-based).
When you fire up the headunit, you have an "Apps" section, which includes the standard stuff - Gallery, calculator, etc, however you also have an "App Installer" app, which looks for APKs.
You can throw an APK onto any USB drive and it will pick it up, however, it will not install - when you select the APK, the installer will be grayed out.
On previous models, (model year 2015), you could get around this by renaming the APK, however that trick does not work on the 2016 North-American trim.

Does anyone know if any progress has been made into this, or how the unit has a "Whitelist" app pool? Perhaps a "package name" approach - i.e. com.honda.navigation - that's contained in some sort of global whitelist?

Any advice is greatly appreciated!
It really irks me when a manufacturer soft-locks features that are already built in, and doesn't even offer you the alternative to unlock them....

 

[epic4grooted]

I'm having the same issue with the ext model

Sent from my Nexus 6 using Tapatalk

 

[SergeiMedvedev]

I'm having the same issue with the ext model

Sent from my Nexus 6 using Tapatalk

This 'issue' (not sure we can really call it that) applies to all trims of the 2016 Civic with the 7" infotainment system.

 

[majedalanni]

+1 I'm looking to thia too but couldn't find anything. All I get interesting is when you hold power+menu and the brightness bottom on the top will start mew menu and after you choose the bottom one you will have couple menues there and if you hold the menu again will get you another menu and if you hold it again will get you another one but couldn't find anything helpfull for apk

 

[epic4grooted]

Does anyone know the actual manufacture of that had unit

Sent from my Nexus 6 using Tapatalk

 

[djg08642]

Does anyone know the actual manufacture of that had unit

Sent from my Nexus 6 using Tapatalk

I was poking around via adb last night and found a few clues.

These are in /system/app:

com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though

http://forum.xda-developers.com/showpost.php?p=66155158&postcount=82

 

[epic4grooted]

what thread is that link to I couldn't get it to come up

I was poking around via adb last night and found a few clues.

These are in /system/app:

com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though

http : // forum . xda-developers . com /showpost.php?p=66155158&postcount=82

 

[djg08642]

what thread is that link to I couldn't get it to come up

Just remove the spaces. I just assumed I'm not allowed to post URLs due to my Junior Member status.

http://forum.xda-developers.com/showpost.php?p=66155158&postcount=82

 

[enyce9]

http://www.clarion.com/us/en/user-support/oss-1/ I don't know if this can help in any way....

Sent from my Nexus 6P using Tapatalk

 

[djg08642]

http://www.clarion.com/us/en/user-support/oss-1/ I don't know if this can help in any way....

Sent from my Nexus 6P using Tapatalk

I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using

adb reboot bootloader

over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.

 

[enyce9]

I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using

adb reboot bootloader

over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.

I stumbled upon the boot mode as well but don't have the balls to try any of the options.

Sent from my Nexus 6P using Tapatalk

 

[epic4grooted]

I stumbled upon the boot mode as well but don't have the balls to try any of the options.

Sent from my Nexus 6P using Tapatalk

We need a dump of our system

Sent from my Nexus 6 using Tapatalk

 

[djg08642]

We need a dump of our system

Sent from my Nexus 6 using Tapatalk

That reminds me I also tried doing an `adb backup`. I accepted the prompt on the head unit and everything appeared to be running as expected but the process resulted in a 41 byte .ab backup file. They've really got these devices locked down.

 

[epic4grooted]

I downloaded it and poked through it. The bootloader stuff might be the only useful stuff in there but I'm no expert. I tried rebooting my head unit into the bootloader using

adb reboot bootloader

over wifi but it just rebooted the head unit and went back into Android.

I'll bet there's a key/button combination that can be held to get into the bootloader menu when powering on the head unit/car. I tried powering on the HU while holding Power, Power + Brightness, and Power + Brightness + Menu to no avail.

While poking around in the Developer Options, I did see a "Boot Mode" menu with a few options: Uploader, SD Boot, USB Boot. I'm a little hesitant to try those out but I'm curious what they do.

Your connecting over wifi?

Sent from my Nexus 6 using Tapatalk

 

[djg08642]

Your connecting over wifi?

Sent from my Nexus 6 using Tapatalk

Yeah, I don't have the heart to tear my dash apart just yet. If I knew where the USB port was in the head unit, I might consider it but I don't want to go in blind.

If we had ADB over USB we'd be set.

 

[epic4grooted]

I'll mess around with it this week end I'm in school for Android development maybe I can put it to use lol

Sent from my Nexus 6 using Tapatalk

 

[enyce9]

According to others in the honda pilot forum there is a hidden usb port in the back of the head unit..... It appears to be usb type B, like on a printer. I have yet to see a picture though.
I should note I own a 2017 ridgeline running 4.2.2.
Is it also safe to assume the only way to get a system dump is by rooting the head unit first?
Sent from my Nexus 6P using Tapatalk

 

[sheryip]

http://forum.xda-developers.com/android/general/guide-how-to-gain-root-shell-2016-honda-t3487644

are we able to do this?

 

[josby]

I was poking around via adb last night and found a few clues.

These are in /system/app:

com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.apk
com.clarion.displayaudio.apps.appmodesip.inputmethod.latin.odex
com.clarion.displayaudio.apps.tenkey.apk
com.clarion.displayaudio.apps.tenkey.odex
com.clarion.displayaudio.colorprovider.apk
com.clarion.displayaudio.colorprovider.odex
com.clarion.displayaudio.filer.apk
com.clarion.displayaudio.filer.odex
com.clarion.displayaudio.menucoloradjust.apk
com.clarion.displayaudio.menucoloradjust.odex
com.clarion.displayaudio.taskmanager.apk
com.clarion.displayaudio.taskmanager.odex
com.clarion.displayaudio.tenkey.apk
com.clarion.displayaudio.tenkey.odex
com.clarion.displayaudio.vehiclecustomize.apk
com.clarion.displayaudio.vehiclecustomize.odex

So I think Clarion's a safe bet.

Fing, the app on my phone I used to find the HU on my network, shows the NIC is Alps Electric.

I'm really hoping we can find a way to root the NA head unit or at least sideload apps. I found a thread last night where it looks like XDA user nanddroid has opened the head unit up and found an internal USB port. At this point, that's probably our best bet for getting write access to the filesystem.

I'm happy to test things out on my own head unit as well. Mine's running 4.2.2. Not willing to rip apart the dash yet though

http://forum.xda-developers.com/showpost.php?p=66155158&postcount=82

And that's a Civic, not a Pilot? I ask because Honda's parts listings show the Pilot HU being made by Clarion, but the NA Civic's made by Mitsubishi. I can connect to my Civic's with adb via wifi but not get it go online (see attached). I think that's because it's not in USB debug mode, because there's no way to turn on developer options, but you didn't seem to encounter any difficulties with that?

 

[k3v1nc]

My 2016 Civic EX-L is has a unit made by Mitsubishi for sure. Clarion sounds like the Pilot to me.
Anyways, something I've been thinking about is trying to get my hands on the software update USB that is part of the TSB 16-022 (http://www.civicx.com/attachments/ml-reaasc6a-usb_drive_sb_16-022-pdf.10010/). The USB update has a honda part number of 07AAZ-TBAA100 and seems to be available from honda parts stores online. I can't find an disk image of it online. If it has a full copy of the OS file system, might be able to extract it and look for vulnerabilities. Or it might be possible to learn how to create a custom update USB. Clearly from the TSB instructions, the headunit recognizes it as a system update and presents a prompt that is different from anything I've seen on it before.