[GUIDE] How to enter developer mode on 2017 Honda Civic (and now root & install apps)

[codeage]

[GUIDE] How to enter developer mode on 2017 Honda Civic (and now root & install apps)

======================

Sticky
Honda has changed the password to enter the developer mode in new vehicle models so the old method described in this thread may not work any longer. If you have difficulty entering the developer mode or do not have a laptop, you may consider trying the new web based installation (paid service). The new method supports almost all Honda vehicles including Civic, CR-V, Accord, Pilot, Ridgeline and Clarity. For more information please refer to: xxxxxxx Mod Edit: Link removed.


======================
Updated 2020.10.02
Display compass and rich vehicle information in the instrument cluster. Display advanced turn-by-turn directions while using Waze. Try it now (for Civic and CR-V only): Mod Edit: Link removed.



======================
Updated 2020.03.08
Support playing FLAC lossless audio directly in the factory USB audio player (for Civic & CR-V only).


======================
Updated 2019.06.22
Open rear camera by one click.
Real-time monitoring of battery voltage with voice alarm.
Seat belt voice alarm.
Show CPU usage, battery voltage in the status bar.

======================
Updated 2018.09.14
New test version: display turn-by-turn navigation directions in the instrument cluster, in conjunction with Waze.

======================
Updated 2018.01.14
A totally new One Click Root tool (Windows GUI version) and Honda Hack app were released. With the help of Honda Hack app, we can install apps without a laptop. What's more, we can enable the steering wheel audio controls, save offline maps and songs to the external USB drive now.

======================
Updated 2017.09.27
Finally I solved the auto reboot problem while remounting the system partition. Enjoy it!!!

======================
Updated 2017.06.26
Now we can root the head unit and install apps. Below are the detailed steps, please use at your own risk.

Detailed steps:
1. Enter developer mode and enable USB debugging.

• Go to HOME > Settings > System > Detail information.
• In the Android Settings window, click About.
• Click the Build Number seven times exactly.
• Now you will see the Please enter a passcord prompt.
• Click the top 4 items in order 1, 4, 2, 3 and you should unlock the developer mode.
• Go into Android Settings > Developer options and enable USB debugging.

​

2. Change the USB role of the head unit from Host to Device.

• Press the power, menu, and brightness button at once, and hold until you enter a new menu with two options.
• Click the bottom option called Detail Information & Settings.
• Now hold the MENU key to enter another menu.
• Then Hold the HOME key to enter the last menu. You should first hear two consecutive beeps and then one final beep.
• Lastly, change the role of USB Port from Host to Device.
• Now connect your laptop to the front Android Auto/CarPlay Port using the USB A to A cable.

3. Run the One Click Root

• Disable your anti-virus and/or anti-malware programs before continue.
• Download the root tool: HondaHack.zip
• Extract HondaHack.exe from the ZIP file.
• Run HondaHack.exe and it should connect to the head unit automatically. Android ADB USB Driver should be installed automatically in the meanwhile.
• Click the ROOT button and wait for the processing to complete.
• After the head unit is rebooted, you should see Honda Installer in the app list. Honda Installer was installed as a system app so you will not lose it after a factory resetting.
• Open Honda Hack and click Install an app to install apk files you saved in the internal sdcard or external USB drive.

4. You can also Install Honda Hack if you would like to have more powerful features including:

• Install apps without a laptop.
• Bypass parking brake.
• Enable steering wheel controls for civic & accord.
• Force landscape mode so apps such as Spotify will display properly.
• Enable write access to the external USB storage (pro only).
• Auto click the OK button at startup (pro only).
• Auto run app at startup (pro only).

View attachment 4388157View attachment 4388158​

5. Change the USB role of the head unit from Device to Host.

• Do this just like the reverse action in step 2, otherwise the USB port will lose its charging capacity and CarPlay / Android Auto will stop working.

Download Honda Hack: HondaHack.apk

If you do not like the GUI version, you can still download the original command-line version from GitHub: https://github.com/codeage/root-honda


Some files and scripts were obtained from this thread: https://forum.xda-developers.com/android/general/guide-how-to-gain-root-shell-2016-honda-t3487644 and all credit goes to @jersacct.

 

[yuprules]

Great job, I'm going to try this on my Honda CRV 2017 later today to see if it works!

 

[josby]

I tried this this morning on my 2016 Civic and it works!

Port 5000 is open for adb on my Civic. Not sure if the port is different on a Pilot or not, but it's different than the standard adb port (5555). I found it by running an nmap scan of my headunit's IP.

Unfortunately even after I enabled Developer mode on my HU, my adb does the same thing it did before. That is, I can adb connect to port 5000 on my HU's IP, but when I do "adb devices", it shows the device there but "offline".

My expectation was that once Developer mode was enabled, connecting via adb would bring up a prompt on the HU asking if I wanted to authorize that remote device.

However, I was doing the adb connection from my PC inside my house, then running out to my garage to check the screen. So maybe I just didn't get there in time to see it. I'm going to try it again from my laptop sitting in my car tonight when I have more time to mess with it.

 

[scififan2715]

Works on my 2017 cr-v! Has anyone had a chance to try usb debugging?

 

[codeage]

I tried this this morning on my 2016 Civic and it works!

Port 5000 is open for adb on my Civic. Not sure if the port is different on a Pilot or not, but it's different than the standard adb port (5500). I found it by running an nmap scan of my headunit's IP.

Unfortunately even after I enabled Developer mode on my HU, my adb does the same thing it did before. That is, I can adb connect to port 5000 on my HU's IP, but when I do "adb devices", it shows the device there but "offline".

My expectation was that once Developer mode was enabled, connecting via adb would bring up a prompt on the HU asking if I wanted to authorize that remote device.

However, I was doing the adb connection from my PC inside my house, then running out to my garage to check the screen. So maybe I just didn't get there in time to see it. I'm going to try it again from my laptop sitting in my car tonight when I have more time to mess with it.

Yes, same problem here. I think port 5000 is not for adb but some other service from Honda.

 

[josby]

Yes, same problem here. I think port 5000 is not for adb but some other service from Honda.

I hadn't considered that. You might be right. I tried connecting adb on my PC to another computer of mine on a port number that I know for sure isn't an adb listener, and it gives that same behavior of just showing that device is "offline".

But, everything I've read indicates you can't connect with adb over wifi until you first connect with USB and authorize the instance of adb on that computer to connect to the device. So I think that could also be the reason we can't get anywhere on port 5000.

I don't have a TypeA-to-TypeA USB cable to try connecting to the car's USB ports with though.

 

[YurS0D1a0]

https://forum.xda-developers.com/an...2016-honda-t3487644/post70868431#post70868431

try adb with the usb port on device mode

 

[codeage]

https://forum.xda-developers.com/an...2016-honda-t3487644/post70868431#post70868431

try adb with the usb port on device mode

Already tried this but does not work.

 

[OldAmber]

Already tried this but does not work.
View attachment 4184875

Hey just making sure before I end up trying the same thing. You tried connecting through the USB port right?

Edit: Turns out you can. I had a friend post about it since my account is new.

 

[codeage]

Hey just making sure before I end up trying the same thing. You tried connecting through the USB port right?

Yes, I tried connecting through the USB port.

 

[viralhax]

thanks

nice information

 

[vraj1470]

Post for OldAmber since his account is new

I was able to establish an adb connection through usb by changing the role to Device. Here's a video just showing it off and a picture just to show I did have shell access.

https://www.youtube.com/watch?v=9nJuMShXW0o

and a pic just show I did have shell access.
http://imgur.com/a/8K8cy

His build number is 1.F186.69

 

[OldAmber]

I tried using the same root method but it looks like our Factory_reset.sh is not located in the same directory, all the files pushed through successfully though.

 

[Kurian8]

I tried using the same root method but it looks like our Factory_reset.sh is not located in the same directory, all the files pushed through successfully though.

can You get and post this file /data/system/whitelist.xml

mayby this method (psneuter): https://forum.xda-developers.com/showthread.php?t=2684210 ?

 

[codeage]

Post for OldAmber since his account is new

I was able to establish an adb connection through usb by changing the role to Device. Here's a video just showing it off and a picture just to show I did have shell access.

https://www.youtube.com/watch?v=9nJuMShXW0o

and a pic just show I did have shell access.
http://imgur.com/a/8K8cy

His build number is 1.F186.69

Glad to know this. I've already tried this but does not work. Maybe I got a bad cable? I will try again later. :laugh:

 

[OldAmber]

can You get and post this file /data/system/whitelist.xml

mayby this method (psneuter): https://forum.xda-developers.com/showthread.php?t=2684210 ?

I tried pulling that file, but it says it does not exist. This might be because I don't have root. And I have not yet tried the psneuter method, but I don't think that would work since I can't install apks as it is.

 

[Kurian8]

I tried pulling that file, but it says it does not exist. This might be because I don't have root. And I have not yet tried the psneuter method, but I don't think that would work since I can't install apks as it is.

I hope at end of week starting doing own tests. First iI'm going to try psneuter and dortyc0w. To test psneuter You don't need install any apks. Just put file to temp directory /data/local/tmp/, lunch shell (adb shell) and change rights to 777 and next try to execute it.

 

[OldAmber]

I hope at end of week starting doing own tests. First iI'm going to try psneuter and dortyc0w. To test psneuter You don't need install any apks. Just put file to temp directory /data/local/tmp/, lunch shell (adb shell) and change rights to 777 and next try to execute it.

Just tried it out and had no luck. I got the following error

255|[email protected]:/ $ cd /data/local/tmp
[email protected]:/data/local/tmp $ chmod 777 psneuter
[email protected]:/data/local/tmp $ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)

 

[codeage]

There's no file whitelist.xml in /data/system/, but I found another file named packages.xml there. I also found the shell script /system/custom/bin/auto_install.sh references to this xml file so I think it is the correct whitelist file. The file packages.xml is readable by root users only so I can not pull it now.




There's no file factory_reset.sh in /system/etc, so I tried to use dirtycow to overwrite another small shell script file /system/bin/mount_debugfs.sh and got the following output:

$ adb shell '/data/local/tmp/rootme/dirtycow /system/bin/mount_debugfs.sh /data/local/tmp/rootme/factory_reset_mod.sh'

But the file /system/bin/mount_debugfs.sh was not changed after the exploiting. Maybe the dirtycow vulnerability has been patched already in this kernel?

 

[Kurian8]

Very nice another steps ahead

Possible it's syntax mistake? Before second file name You missed trailing / in path
Can You try it again:

$ adb shell '/data/local/tmp/rootme/dirtycow /system/bin/mount_debugfs.sh [COLOR="Red"]/[/COLOR]data/local/tmp/rootme/factory_reset_mod.sh'