HACK Navigation/Multimedia systems KIA/HYUNDAI and install third-party applications

Search This thread

Joan_of_Arc

Member
Apr 17, 2020
47
6

eried

Inactive Recognized Developer
May 10, 2010
303
125
ried.cl
Hello, i used to know a program that could crack zip passes but cannot recall its name. Here are a few options you can try though.
Considering that the password is long, any software will take ages. And there is no files to find partial matches inside this zip, to find a shortcut 😐
 

mikbe

Senior Member
Jul 23, 2010
978
176
Hei! Kia Optima EU PHEV here, Gen5 Compact, I can enter to dealer mode with 7-3-1 2400 but no engineer mode. Any help?

I already tried, without luck:

0000 1111 0625 0652 2801 2700 2701 2702 2603 2504 2405 2306 2207 2108 2009 2889 2600 2800 2900 Current time in military time
Same here. I've got 2019 Optima PHEV with updated full GEN5 and dealer mode is all I can access to. Any help with this?
 

eried

Inactive Recognized Developer
May 10, 2010
303
125
ried.cl
Same here. I've got 2019 Optima PHEV with updated full GEN5 and dealer mode is all I can access to. Any help with this?
Have you tried with the "easy fire tools"? Google that, I cant in mine because it is updated to 2022, but maybe if you havent updated you still can install the apk via that method
 

mikbe

Senior Member
Jul 23, 2010
978
176
Have you tried with the "easy fire tools"? Google that, I cant in mine because it is updated to 2022, but maybe if you havent updated you still can install the apk via that method
The old version was just bloody ugly so I had to do it. 😅 I guess that app would work if there was some way to enable Adb on the car.
 

RuslandM

New member
Aug 21, 2022
1
0
Hello. help, I need to change the language / region to kia optima sx 2019. I brought it from the usa to russia.
20220821_202212.jpg
 

Joan_of_Arc

Member
Apr 17, 2020
47
6
I have successfully cracked the password for models with Gen5 navigation: https://xakcop.com/post/hyundai-hack/
Unfortunately, update.zip is also signed with the attached certificate. Anyone can find the corresponding private key? Or any other ideas how to exploit Android 4.2 and get root?
Great write up cant wait to reverse the kia files. Perhaps if it is 4.2 "geohot towelRoot" will work?

Also ..whenever i try to update with thumbdrive it just keeps playing the mp3 files that come with the update.. anyone have any ideas on how to remedy this? I have a 2019 forte so no sd card slot.

Finally i have tried altering files and such but cannot seem to get into adb settings i seen on the 7th page of this thread you could take unit out solder some things and then flash but im not willing to void the warranty on the car. So i will use an android box in the meantime,until i can get a better one if anyone is interested i can start a new thread on getting it up and running but there is a whole telegram Group. Edit: This is the xda page.
 
Last edited:

westwood24

Senior Member
Feb 10, 2011
158
463
Bamberg
I have successfully cracked the password for models with Gen5 navigation: https://xakcop.com/post/hyundai-hack/
Unfortunately, update.zip is also signed with the attached certificate. Anyone can find the corresponding private key? Or any other ideas how to exploit Android 4.2 and get root?
Can anyone do this for the eu firmware PDEN? btw I30N? i can´t find the password for the update.zip.
 

Attachments

  • update_package.zip
    222.3 MB · Views: 23
Last edited:

Joan_of_Arc

Member
Apr 17, 2020
47
6
Can anyone do this for the eu firmware PDEN? btw I30N? i can´t find the password for the update.zip.
I will try and let you know, i need to know how to convert date to dos format my files were modified 22-04-11 not 22-04-21 so 9554 is not correct. But yours were, so i will let you know i have a ryzen 9 so bkcrack only takes a few minutes.

Edit: no luck but i may have set up something wrong as im getting 17bytes instead of 3.
IMG_20220822_012455.jpg
 
Last edited:

Joan_of_Arc

Member
Apr 17, 2020
47
6
The password is 5FF4FAE90578448FE5DE1E106D91. Let me know if you find how to flash modified updates or other way to exploit.
Hey xak could you give me the secret to converting to dos dates and perhaps an idea of what im doing wrong to get 17 bytes instead of 3, i can try on linux tomorrow if necessary.

Also i think to flash modified update all you have to do is increment one of the numbers in navi_version.txt it was in a previous post stating a way to trick navi into going into adb mode but it didn't work for me that way maybe with unlocked folders it will. I will have to re-find the post though it is maybe page 30-40?
this is tree to Navi_Version.txt for me 2019_Forte_4Door_USA\BIN\G40\Navi_Version.txt
for us firmware this is the tree to the update.zip DAUDIOPLUS\usa\bd_4d\update\system\update_package.zip
 

Attachments

  • update_package.zip
    227.4 MB · Views: 19
Last edited:

xakcop

New member
Nov 12, 2008
3
3
Hey xak could you give me the secret to converting to dos dates and perhaps an idea of what im doing wrong to get 17 bytes instead of 3, i can try on linux tomorrow if necessary.

Also i think to flash modified update all you have to do is increment one of the numbers in navi_version.txt it was in a previous post stating a way to trick navi into going into adb mode but it didn't work for me that way maybe with unlocked folders it will. I will have to re-find the post though it is maybe page 30-40?
this is tree to Navi_Version.txt for me 2019_Forte_4Door_USA\BIN\G40\Navi_Version.txt
for us firmware this is the tree to the update.zip DAUDIOPLUS\usa\bd_4d\update\system\update_package.zip
The password for this update package is AD0674C5A5EFA1DFC40A933DC8D9.
You can try to modify update.zip and repackage but I don't think it will work because the zip is signed. The Android recovery system is checking this signature when you try to install OTA updates.
 
  • Like
Reactions: Joan_of_Arc

westwood24

Senior Member
Feb 10, 2011
158
463
Bamberg
The password for this update package is AD0674C5A5EFA1DFC40A933DC8D9.
You can try to modify update.zip and repackage but I don't think it will work because the zip is signed. The Android recovery system is checking this signature when you try to install OTA updates.
I have found the getkeystring
but the table with the passwords i don´t find. :rolleyes:
I need it to open the engineer menu.
Can you tell me how it is?

edit: Have found it
 
Last edited:

eried

Inactive Recognized Developer
May 10, 2010
303
125
ried.cl
On contrary to a zip file, I think KIA update is in this lgk file:


Capture.JPG


It does not has any recognizable structure inside, so I guess is just the filesystem raw with some lightweight encoder. Has anyone played with this? I still cant access my Engineering menu after testing all the published 4 digit passwords, only dealer mode 😪
 

Joan_of_Arc

Member
Apr 17, 2020
47
6
The password for this update package is AD0674C5A5EFA1DFC40A933DC8D9.
You can try to modify update.zip and repackage but I don't think it will work because the zip is signed. The Android recovery system is checking this signature when you try to install OTA updates.
Thank you, im in now
here is tree to get to apps 2019_Forte_4Door_USA\DAUDIOPLUS\usa\bd_4d\update\system\update_package\update\system\app
however when i try to us baksmali it gives me the error of: Unable to access jarfile baksmali-2.5.2.jar, so im trying to download kali atm so i can try on linux.
 

Attachments

  • HKMC_EngineerMode.zip
    590.4 KB · Views: 14

Joan_of_Arc

Member
Apr 17, 2020
47
6
This is the file that was spoken of to trick navi into starting adb but it has a different password.
Tree: 2019_Forte_4Door_USA\BIN\G40
 

Attachments

  • image_2022-08-22_144705142.png
    image_2022-08-22_144705142.png
    423 KB · Views: 43
  • G40.zip
    18.5 MB · Views: 12
  • Navi_Version.txt
    29 bytes · Views: 12

Joan_of_Arc

Member
Apr 17, 2020
47
6
Hello,
Decided to start decompiling the engineering mode apk as it is an easier attack vector than odex for me.
Tree is : decompile HKMC_EngineerMode.apk with apktool M
/HKMC_EngineerMode_src/res/xml/adb_setting.xml

Shouldn't we just flip these falses to true recompile, rezip and flash "upgrade"?
 

Attachments

  • Screenshot_20220823-000918_Apktool M.jpg
    Screenshot_20220823-000918_Apktool M.jpg
    160 KB · Views: 66
  • Like
Reactions: eried

lukilodz83

New member
Aug 24, 2022
4
2
Hi,

I have this case with my KIA Sorento and GEN4 infotainment system. The car is from 2016, and the system has never been updated, so as you can see, it's from 2015, and it's Android 2.3.4.
The car is from the US, and I'm in Poland. And my question is:

- when I will be updating the system through Map Updater, can I choose maps for Europe and run the update process, or will it brick the device and I have to stick with the US version?

Honestly, maps are not so crucial for me as long as I will have Android Auto and will be able to use google maps and I know this system should have this option.

The second case is that I'm able to enter engineering mode by going to Settings -> System info -> Storage and tapping 5 times on the vertical line and one on the right bottom corner. Most of the menu is in Korean, yet I was able to find Radio coding settings (need to change for European standards). The problem is that my changes are not saved. Changing, applying, restarting but nothing has changed. I also don't have to put any codes when entering mode.
 

Attachments

  • 1658232884828.jpg
    1658232884828.jpg
    37.1 KB · Views: 21
  • 1658232884814.jpg
    1658232884814.jpg
    43.8 KB · Views: 21

Joan_of_Arc

Member
Apr 17, 2020
47
6
Hi,

I have this case with my KIA Sorento and GEN4 infotainment system. The car is from 2016, and the system has never been updated, so as you can see, it's from 2015, and it's Android 2.3.4.
The car is from the US, and I'm in Poland. And my question is:

- when I will be updating the system through Map Updater, can I choose maps for Europe and run the update process, or will it brick the device and I have to stick with the US version?

Honestly, maps are not so crucial for me as long as I will have Android Auto and will be able to use google maps and I know this system should have this option.

The second case is that I'm able to enter engineering mode by going to Settings -> System info -> Storage and tapping 5 times on the vertical line and one on the right bottom corner. Most of the menu is in Korean, yet I was able to find Radio coding settings (need to change for European standards). The problem is that my changes are not saved. Changing, applying, restarting but nothing has changed. I also don't have to put any codes when entering mode.
Dobry den přitel a jak se maš? i believe this is what you are looking for.

As for bricking the system i haven't seen anyone else have that issue as we have a lot of Russians who convert their units.
Even then you can always hook up a keyboard and factory reset it.

Not sure why radio changes aren't staying mine have, i turned on hd audio, changed frequencies and even turned on uvo telematics (doesnt work though i dont have a sim ) even changed the unit to hud+ (dunno if it makes a difference? it seems to load slower is all i noticed.)

Perhaps go into dealer mode first. system info (volume 7(tune) 3(tune) 1(tune) then 2400 and verify.
 
  • Like
Reactions: lukilodz83

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    I got in engineering mode on my KIA Carens 2022 model Luxury Plus 7DCT petrol.10”inch with Kiaconnect network.Wired Carplay only.

    !Please do it at your own risk.

    =>Its Andriod 4.4.2 version.
    =>Install 3rd party apps.eg;EasyTouch.apk,ES File manger, Many more apps can be installed as per supported andiod ver 4.4.2
    =>Set default launcher. Always or just once.

    1.How to go Engineering mode very easy.
    =>Choose Radio -> FM
    =>Set the volume to 2
    =>Press the Setup button or choose All menus -> Settings
    =>Choose General
    =>Tap 5 times left from the Update button and tap once right from the Update button.
    Passcode 2702.

    2.Go to Module Info=>Click next=>next to page 3/4 as shown in below.
    3.How to show ADB mode?
    Click bottom right corner of screen 5 times and ADB setting will appear.
    4.You can enable adb usb & tcp.Make sure adb drivers installed on pc.
    5. Connect usb male to usb male cable to laptop. Device manager will show the devices daudioplus.
    6. Get any adb platform files installation.
    install any apk => adb devices
    adb install Chrome.apk
    6.1 Unknown Source Enable Via adb
    adb shell settings put global install_non_market_apps 1
    6.2 Installed List packages name via adb command
    installed and un-hidden apps
    =>adb shell pm list packages
    Hidden & installed apps
    =>adb shell pm list packages -u
    6.3 Start app by package name eg; Carlauncer package name =>com.autolauncher.motorcar
    adb shell monkey -p com.autolauncher.motorcar -c android.intent.category.LAUNCHER 1
    6.4 Developer mode enable by adb command.There will be no setting or option visible.
    adb shell settings put global development_settings_enabled 1
    7.ES Explorer,Car launcher installed,You even can see real andriod like tablet.CWG launcher installed.EasyTouch.apk is very useful to access anywhere on any Kia launcher.
    8. Chrome is installed and can able to watch youtube. Seems depends on it.
    9.I connected to wifi by settings option.And can stream videos.Still its not clear if there is hardware than why its connected to wifi.

    Issues:
    1.Installed vanced youtube but network issues. Tried a different version but not able to connect to internet.
    Cautious=>Smartubenext seems workable but it makes device reboot issue. Seems depends on chrome.
    2.There is some issue to install apk via file manager because Next Button not able to click and only adb mode installed many apps. Need try usb mouse if its working.
    3.Wifi module check shows no info, but i do connected to wifi.Wireless not build in system.



    ADB MODE KIA CARENS 2022.jpg
    ADB MODE KIA CARENS2.jpeg
    0113B2F8-E5AA-44AE-B465-B8E9B28D2C16.jpeg

    CARLAUNCHER APP (3).jpeg

    LAUNCHER2.jpeg
    2
    @phucnv20693 and @sg.levinh

    Greetings. While we understand the allure of wanting to communicte in your native language, I will ask you politely to please be respectful of XDA Rule #4 for
    all of your future posts:
    4. Use the English language.

    We understand that with all the different nationalities, not everyone speaks English well, but please try. If you're really unable to post in English, use an online translator. You're free to include your original message in your own language, below the English translation. (This rule covers your posts, profile entries and signature). You could try :- https://translate.google.com/ or https://www.babelfish.com/ or use one of your choice.

    Thank you for your cooperation, and have a pleasant day.

    -Regards: Badger50
    1
    thử theo cách này là được bác ạ
    Được rồi bạn ơi , mà giờ mình mún khắc phục cắm android box vào không nhận giọng nói , mua box về mà ko sử dụng được giọng nói khó chịu gì đâu

    Mod translation: Okay my friend, but now I want to fix it when I plug in the android box and don't receive the voice, I bought the box but I can't use the annoying voice.
    1
    View attachment 5713199View attachment 5713195I got in engineering mode on my KIA Carens 2022 model Luxury Plus 7DCT petrol India.
    =>Its Andriod 4.4.2 version.
    =>Install 3rd party apps.EasyTouch.apk,ES File manger, Many more apps can be installed.
    =>Set default launcher.

    1.How to go Engineering mode very easy.
    =>Choose Radio -> FM
    =>Set the volume to 2
    =>Press the Setup button or choose All menus -> Settings
    =>Choose General
    =>Tap 5 times left from the Update button and tap once right from the Update button.
    Passcode 2702.

    2.Go to Module Info=>Click next=>next to page 3/4 as shown in below.

    =>3.How to show ADB mode? => Click bottom right corner of screen 5 times and ADB setting will appear.
    4.You can enable adb usb & tcp.
    5. Connect usb male to usb male cable to laptop.Device manger will show the devices also in winodws.

    6. Get any adb platform files installation.
    push any apk => adb devices
    adb install filename.apk
    7.ES Explorer,Car launcher installed,You even can see real andriod like tablet.EasyTouch.apk is very useful to acces anywhere on any launcher.
    8.Chrome is installed and can able to watch youtube.
    9.I connected to wifi by settings option.And can stream videos.Still its not clear if there is hardware than why its connected to wifi.will share the scrrenshot of wifi connected.
    Issues:
    1.Installed vanced youtube but network issues. Tried different version but not able to connect to internet.
    2.There is some issue to install apk via file manager becase Next not able to click and only adb mode installed many apps.
    3.Wifi module check shows no info,but i do connected to wifi.



    View attachment 5712001View attachment 5712009View attachment 5713197
    Hey @nanerasingh thank you for taking the time to post about your findings and how to go about getting to the engineer menu. Even though I seem to have a different UVO the steps seemed to work just the same.

    I pushed my app to the UVO via the adb command

    adb install app-debug.apk
    1663439017341.png


    and it worked just fine:
    1663438993586.png


    However, moving back to the main menu on the UVO I do not noticed any new icon - the icon that should look something like this:
    1663439109216.png


    was not present on any of the 3 "swipe" screens I have?

    <side note - I also tried uninstalling it and re-installing it and it seemed to not show up still:>
    1663439938487.png


    I am unsure where the
    -ES Explorer
    -Car launcher
    -tablet.EasyTouch.apk

    come into play here? Do I need to install those apps in addition to my own (apk-debug.apk) in order for it to show up on the UVO menu?

    I have the newer (2022) UVO that looks like this:
    1663439385625.png


    With these specs (in case you are interested):
    1663439657049.png

    1663439679354.png

    1663439716685.png


    It would be great if you could give a more detailed explanation of how to go about getting an installed app via ADB to show up on the main menu. :)
    1
    Would this be the same thing as the adb shell monkey -p app.package.name -c android.intent.category.LAUNCHER 1

    Bash:
    adb shell am start -n com.example.tellurideuvoapp/com.example.tellurideuvoapp.MainActivity

    Or does your command actually place it on the UVO home screen?

    It's been said not to root or remove/replace the original launcher in fear it will break the overall program. Kinda be difficult to explain to Kia how my UVO just decided to stop working.

    Is the appapk.apk the car launcher app? Neverminded, just seen its a list of apps.
    Package Name
    com.autolauncher.motorcar.free

    I you want to open this above app than below command. checkout.
    adb shell monkey -p com.autolauncher.motorcar.free -c android.intent.category.LAUNCHER 1

    no its not rooting steps.
  • 15
    :D Sorry for my English! :D
    CAUTION: USE THIS AT YOUR OWN RISK!
    YouTube, your favorite navigation app, video player, online radio, online TV etc. now works on factory multimedia.
    No need to connect your multimedia to internet!
    This method works fine on models 2016-2018 of issue:
    KIA: Optima JF (K5), Rio, Soul, Ceed, Sorento Prime, Stinger, Sportage, Cerato (Forte) (may be other).
    HYUNDAI: Solaris, SantaFe, Sonata, Elantra, Creta, Genesis G70, Genesis G80 (may be other).
    On board we have Navigation/Multimedia system on Android 4.2.2;

    All fine-work applications on my Cloud drive HERE
    Please watch all videos from my YouTube channel Everything about everything

    If you like this please — Donate!:fingers-crossed:
    PayPal – [email protected]
    If you are not sure in your actions - I can lead you by Skype (WhatsApp, Telegram)

    WARNING!
    Do not install any LAUNCHERS (NovaLauncher etc.) or ROOT - it`s brick your device.
    Do not do anything else! Do not enter in other sections of Engineering mode.
    Be patient and follow the instructions strictly!

    FIRST:
    Download all the apps from my Cloud drive HERE
    And put all this files to root of the USB drive (FAT32)

    Let`s Go!
    This hack method no need`s to connect your multimedia to internet, if necessary
    - activate wifi access point on your phone or use wifi router. Connect your multimedia system to hotspot.
    You can watch my VIDEO MANUAL on YouTube HERE

    ENGINEERING MODE:
    Go to All Menus -> Settings -> Screensaver.
    To enter in the Engineering mode you need to tap 7 times under screensavers icons (on red rings) from left to right and back.

    do it fast.
    Great! Now we have password window! The password is – time on your clock now!


    Ok, its luck!

    ANDROID SETTINGS:
    Now we need to enter to Android settings -> Security and activate Unknown resources.

    Done! This will give us the opportunity to install applications from the USB drive.
    Note: this system hasn`t go Google apps, Play Market etc.
    Push Home button and then we need to access to Engineering mode again.

    INSTALLING FILE MANAGER:
    To access to the USB drive and install all the applications we need to install File Manager first!
    Go to All Menus -> Settings -> Screensaver, tap-tap-tap-tap-tap-tap-tap, password - time on clock.
    Engineering mode -> All Applications -> Browser

    On adress bar write: file:///storage/usb0/file.apk and tap OK!

    Now you can install the File Manager, install it and tap Open!


    Got it!

    INSTALLING APPS:
    In File Manager -> USB Storage you will see all apps.
    Fist install EasyTouch, when it`s intalled tap Open.

    Play EasyTouch Demo and them tap Go.
    Note: EasyTouch Settings works only on portrait orientation (don`t be afraid it`s mormal).
    So, there are many settings, they are no need us now, we need just activate EasyTouch button.

    Done! Now push Home and than tap EasyTouch button to open а window. Now we have BACK and HOME buttons.


    With long press on any icon in this window it can changed. Change one of them by choosing Engineering mode shortcut on Choose app -Done! Tap anywhere to close window.
    Call the window again, swipe left and open Android settings -> Special abilities -> Services EasyTouch - ON

    That’s Ok, now we can normally surf in internet and have all shortcuts of any apps.

    SOUND FIX:
    Note: Sound on third-party apps works only on MEDIA MODE whit connected USB flash drive (with media files) or with connected Bluetooth device.
    On RADIO or AUX MODE sounds from third-party apps doesn’t works!
    So, push EasyTouch button then swipe window and choose File Manager. Open USB storage and install SoundAbout, the Open it.

    Now we in SoundAbout settings. Choose on MEDIA AUDIO - Wired Headphones and that`s all.
    Tap EasyTouch button and BACK.
    Now we need to restart the multimedia - push reset button in SD card slot one time (or find it near you screen). Or you can turn off ACC, open and close driver door and wait 5 minutes to restart the Multimedia.
    Sound fixed!
    Now you can install any apps and it will be working fine with sound!

    YOUTUBE:
    On board we hasn`t got Google apps, so we need to install YouTube modification – YOUTUBE VANCED
    Push EasyTouch button then swipe window and choose File Manager. Open USB storage and install YouTube Vanced.
    Now you can try it!
    Open EasyTouch window and place YOUTUBE VANCED shortcut.

    VLC PLAYER:
    Push EasyTouch button then swipe window and choose File Manager. Open USB storage and install VLC Lite.
    Go to VLC Settings -> Hardware accelerationFull acceleration. Set it because we has poor hardware.
    Now you can watch films, clips, cartoons and everything you want from your USB flash drive or SD card.
    Don`t forget about shortcut.

    HERE NAVIGATION (or another favorite navigation):
    Note: Do not forget to connect WIFI first.
    Push EasyTouch button then swipe window and choose File Manager. Open USB storage and install HERE WeGo, launch, place shortcut.

    You can install everything applications you need but remember:
    DO NOT INSTALL ANY LAUNCHERS AND ROOT. DO NOT OPEN ANYTHING ELSE IN THE ENGINEERING MENU.

    If you are not sure in your actions - I can lead you by Skype (WhatsApp, Telegram)
    Thanks!:victory:
    7
    Just purchased a 2022 Telluride SX with the wide screen. Been reading this thread and noticing no one has found a way to get into engineering mode for these newer firmware, right?

    I would just like to side load some apps and be able to run them from the Kia main menu.

    If for some reason I am incorrect in that there’s no way to side load these newer widescreens then please do let me know. It’s Likely I may have scanned across a post or something that had that info.

    Thanks!

    Today on the Valentines day we have made a secret go public.
    We have been able to gain root access on the Gen5WIDE headunits from europe.

    with this hack you can grab and dump the whole system.
    extracts info, keys, decrypt files and perhaps create ur own custom fw.

    we provide this info for free, so people can share knowledge and new findings.

    Please be aware that this is mainly for devs and technical nerds and linux lovers. untill someone perhaps creates a more user friendly hack.

    Happy hunting

    4
    Hi guys,
    On my Tucson (2018 - AA) I can only access the engineering mode where I don't...

    Update on another model thet does not allow the "full engineering menu":
    2018 Elantra SEL USA version.
    NO: Cannot access the engineering mode that enables app installations (7 taps over 3 points on settings/screensaver).
    YES. Can access the engineering mode from Settings/System Info (5 taps left - 1 tab right).

    Looking forward to the hero that finds out how to jailbreak these versions!!
    3
    Now that we can sideload apps, is there any way to let Android auto work wirelessly?

    Inviato dal mio MI PAD 4 utilizzando Tapatalk

    Of course ! Just install Headunit Reloaded (4.6) on the car system.
    Set it with your phone name (SSID) used for wifi server, and leave IP blank (auto).

    The wifi mode of Headunit will automatically connect to Android Auto if this one is in developer mode and its server mode launched.

    Everything can be totally automatic, the phone can stay in the pocket. Android Auto appears on the main screen few seconds after the wifi connnection to the phone.
    3
    Here is a video explaining everything