hacking nac peugeot

crazychimp80

New member
Jun 22, 2018
1
0
0
hello,
anyone can help me to find a way to unlock/hack the infotainment system on the new peugeot 3008/5008 ecc.
i've tried to hold note button for engineering mode but only for spy menu.
anyone have more differently code for unlock android setting? for example how the kia/hyundai cars?
please sorry for my english....
 

umbeluxa

New member
Jul 3, 2017
3
2
0
hi guys, I'm also looking for a way to get into the hidden menu of the NAC (3d Connect Nav) Peugeot. My car is a 2008, with CarPlay, Mirrorlink and Android Auto. Now compared to what I saw for the KIA, I would try to figure out if there is a chance to enter the system that is declared Linux, and find a gateway like an android virtual emulator, on which even turns android auto, to install other applications directly on the multimedia of the car. The only 2 codes we know are: 1111 1122, the first for spylogs, the second one gives us a series of info on the system, but apparently they are only legible and there is no way to get inside. In practice using the code 1122 the first time also gave me only info on the radio, but then typing in increasing order the following codes and typing 1122 again, for several times I have drawn many other info. I took pictures that I would like to share with you to find out if there is a chance to find a way.
 
Last edited:
  • Like
Reactions: crazychimp80

umbeluxa

New member
Jul 3, 2017
3
2
0
hi guys, I'm also looking for a way to get into the hidden menu of the NAC (3d Connect Nav) Peugeot. My car is a 2008, with CarPlay, Mirrorlink and Android Auto. Now compared to what I saw for the KIA, I would try to figure out if there is a chance to enter the system that is declared Linux, and find a gateway like an android virtual emulator, on which even turns android auto, to install other applications directly on the multimedia of the car. The only 2 codes we know are: 1111 1122, the first for spylogs, the second one gives us a series of info on the system, but apparently they are only legible and there is no way to get inside. In practice using the code 1122 the first time also gave me only info on the radio, but then typing in increasing order the following codes and typing 1122 again, for several times I have drawn many other info. I took pictures that I would like to share with you to find out if there is a chance to find a way.
First of all, does anyone know that LINUX can run Android within? Would it be possible to enter the NAC system to install Android apps?
 
  • Like
Reactions: crazychimp80

Crunchy_Nuts

Member
Apr 9, 2018
9
5
0
Any progress here?
I'm also try to hack in the nac.
I scanned for open ports in Bluetooth and Wifi but all ports are closed.
Does anyone has another idea how i can get access to the system files?
 

Crunchy_Nuts

Member
Apr 9, 2018
9
5
0
It's from the RCC, not the NAC.
RCC is from Bosch and the NAC from Continental.

And it's useless unless you have the login data or the schematics from the board because all ports are closed. :eek:
Maybe a secret code open the ports.
But so far only 1111 and 1122 are known.
 

josz

Member
Feb 23, 2010
10
0
0
It's from the RCC, not the NAC.
RCC is from Bosch and the NAC from Continental.

And it's useless unless you have the login data or the schematics from the board because all ports are closed. :eek:
Maybe a secret code open the ports.
But so far only 1111 and 1122 are known.
According to information published on https://fccid.io/ZFW-NACEUR2. This should be the source of the NAC WAVE 2 and 3.
Excludes are sources of proprietary software.
It seems that the software developed for the RCC unit, is (partly?) used for the NAC.
:confused::confused::confused::confused::confused:

The base of the OS is GENIVI. A linux based OS developed for in car systems.
https://events.static.linuxfound.or...tware updates for Linux-based IVI systems.pdf.
It is designed to prevent the hacking of the system in any way.
 
Last edited:

BobM2019

New member
Oct 16, 2019
4
3
0
For those of you who want to analyze their spy logs after using code 1111, you need to install Qt (qt.io/download) and download the DLT Viewer project (github.com/GENIVI/dlt-viewer). You also need a tool to extract lz4 compressed files (e.g. github.com/lz4/lz4/releases). Once you configure everything you need to extract the .lz4 file (e.g. "1_startup_20190924_181656.dlt.lz4") which results in a .dlt file (e.g. "1_startup_20190924_181656.dlt"). You can then open this in DLT Viewer.

I assume that the Navi 5.0 is using a logger similar to the one described here: github.com/GENIVI/dlt-daemon] . Also based on the information in some of the crash reports, the Navi 5.0 seems to be using Qt apps/objects.
 
  • Like
Reactions: MitchtheMitch

MitchtheMitch

Member
Sep 28, 2019
10
0
0
Unfornately I do not really know how to install all these programs.

I could install qt and visual.

But all other failed.

Can you maybe do a tutorial for that?

I would be verry thankful :D

Regards
 

BobM2019

New member
Oct 16, 2019
4
3
0
I'll try to detail the steps for Windows as soon as I get a chance.

I installed Qt 5.12.5 + Microsoft Visual Studio 2015. When configuring the Qt Kit, I selected no C compiler and "Microsoft Visual C++ Compiler 14.0 (x86_amd64)" as the C++ compiler. After that I was able to build and run the DLT Viewer project.

The lz4 command-line utility is pretty straight-forward. Simply run "lz4.exe <file name>.dlt.lz4" to extract the files.
 
  • Like
Reactions: MitchtheMitch

MitchtheMitch

Member
Sep 28, 2019
10
0
0
That's a problem fo me, I could install qt and visual but that's all.

I do not have exe files for iz4 and for dlt I do not have too. :(

So if you could do a tutorial with links step by step it would be verry cool :D

Thanks
 

BobM2019

New member
Oct 16, 2019
4
3
0
DLT Viewer - Step by Step for Windows

I have been busy, so it took me some time :) The output of DLT Viewer will probably make no sense to many people, but you can draw your own conclusion at the end. I uninstalled and re-installed everything from scratch to note down each step. This assumes that you have exported the spy logs using code 1111 and that you have placed them on your PC.

  1. Download a tool to extract the lz4 compressed spy logs.
    • None of the 7-zip tools/plugins worked for me.
    • From the command-line you can use one of the binaries here: github.com/lz4/lz4/releases . Simply run "lz4.exe <file name>.dlt.lz4" from the command-line to extract the files.
    • For a GUI interface, see reboot.pro/topic/22062-lz4-compressor . Within the tool, in the VHD file field you need to select your lz4 file (e.g. "1_startup_20190924_181656.dlt.lz4"). Select the output folder in the Lz4 Folder field. Leave the LZ4 field empty. Click on the COMPRESS button to extract the file (I know, the name of the button doesn't make sense).
    • You should end up with a .dlt file.
  2. Download and install Visual Studio Community Edition 2015: stackoverflow.com/questions/44290672/how-to-download-visual-studio-community-edition-2015-not-2017
    • During installation select Custom install and Programming Languages -> Visual C++
  3. Download and unzip DLT Viewer: github.com/GENIVI/dlt-viewer/archive/master.zip
  4. Download and install Qt 5.12.6: download.qt.io/official_releases/qt/5.12/5.12.6/qt-opensource-windows-x86-5.12.6.exe
    • During installation select the following component: Qt -> Qt 5.12.6 -> MSVC 2015 64-bit
  5. Configure the compiler in Qt
    • Go to the Tools menu -> Options
    • Select Kits in the left pane -> Kits tab
    • Click on "Dekstop Qt 5.12.6 ..." under "Auto-detected"
    • Select for Compiler C: <No compiler>
    • Select for Compiler C++: Microsoft Visual C++ Compiler 14.0 (amd64)
  6. Compile and run the DLT Viewer project
    • Within Qt click on Open Project and open the BuildDltViewer.pro project in the unzipped folder of DLT Viewer.
    • Qt will switch to the Projects page (otherwise click on Projects on the left)
    • For the Active Project, BuildDltViewer should be selected
    • Click on Configure Project on the right
    • Go to the Build menu -> Build Project ...
    • When the build is finished, go the Build menu -> Run
    • Go to File -> Open and open one of the .dlt files.
    • The DLT Viewer manual can be found here: at.projects.genivi.org/wiki/display/PROJ/DLT+Viewer+Manual

I haven't spent much time looking at the DLT Viewer output, so I cannot help anyone to decipher that. Obviously feel free to share any of your findings.
 
  • Like
Reactions: MitchtheMitch

ricardoestefano

New member
Jan 2, 2020
1
1
0
New Codes Found

Nice work, Bob.

I live in Brazil and my Citroen C4 Cactus seems to use this same unit.
I reached the "Expert Mode" pressing MENU for 10 seconds and the tried the 1111 and 1122 codes.
Here 1111 brings me up the "spy" files, that I extracted using a pendrive, lz4.exe and read with a simple text editor, that does not show the file in a structure but give a good idea that what is inside it.
1122 brings only radio information.
Some news, discovered in this interaction:
1144 disabled the system beep.
1155 enabled the system beep.
I´m just downloading the source code to have an idea on how it works.

I found some schematics at web a few months ago. I will try to recover it and post here.
It will be wondering if we can get Android Auto Wireless working with these units.

Regards,

Estefano

I have been busy, so it took me some time :) The output of DLT Viewer will probably make no sense to many people, but you can draw your own conclusion at the end. I uninstalled and re-installed everything from scratch to note down each step. This assumes that you have exported the spy logs using code 1111 and that you have placed them on your PC.

  1. Download a tool to extract the lz4 compressed spy logs.
    • None of the 7-zip tools/plugins worked for me.
    • From the command-line you can use one of the binaries here: github.com/lz4/lz4/releases . Simply run "lz4.exe <file name>.dlt.lz4" from the command-line to extract the files.
    • For a GUI interface, see reboot.pro/topic/22062-lz4-compressor . Within the tool, in the VHD file field you need to select your lz4 file (e.g. "1_startup_20190924_181656.dlt.lz4"). Select the output folder in the Lz4 Folder field. Leave the LZ4 field empty. Click on the COMPRESS button to extract the file (I know, the name of the button doesn't make sense).
    • You should end up with a .dlt file.
  2. Download and install Visual Studio Community Edition 2015: stackoverflow.com/questions/44290672/how-to-download-visual-studio-community-edition-2015-not-2017
    • During installation select Custom install and Programming Languages -> Visual C++
  3. Download and unzip DLT Viewer: github.com/GENIVI/dlt-viewer/archive/master.zip
  4. Download and install Qt 5.12.6: download.qt.io/official_releases/qt/5.12/5.12.6/qt-opensource-windows-x86-5.12.6.exe
    • During installation select the following component: Qt -> Qt 5.12.6 -> MSVC 2015 64-bit
  5. Configure the compiler in Qt
    • Go to the Tools menu -> Options
    • Select Kits in the left pane -> Kits tab
    • Click on "Dekstop Qt 5.12.6 ..." under "Auto-detected"
    • Select for Compiler C: <No compiler>
    • Select for Compiler C++: Microsoft Visual C++ Compiler 14.0 (amd64)
  6. Compile and run the DLT Viewer project
    • Within Qt click on Open Project and open the BuildDltViewer.pro project in the unzipped folder of DLT Viewer.
    • Qt will switch to the Projects page (otherwise click on Projects on the left)
    • For the Active Project, BuildDltViewer should be selected
    • Click on Configure Project on the right
    • Go to the Build menu -> Build Project ...
    • When the build is finished, go the Build menu -> Run
    • Go to File -> Open and open one of the .dlt files.
    • The DLT Viewer manual can be found here: at.projects.genivi.org/wiki/display/PROJ/DLT+Viewer+Manual

I haven't spent much time looking at the DLT Viewer output, so I cannot help anyone to decipher that. Obviously feel free to share any of your findings.
 
  • Like
Reactions: BobM2019

pedrera

Senior Member
Dec 10, 2007
105
6
0
Geneva
NAC Wave 2 codes (from German PSA forum)

1111 Spy log generation

1122 Master mask

1130 Information about amplifier, battery etc

1133 Information about radio / received / freq

1134 Information on satellites and services

1135 TomTom version

1136 Information about WiFi devices

1137 current user status, temp.

1138 Linux, USB, processor utilization

1139 GPU memory load

1140 connection status WiFi, tethering, Bluetooth, rndis, ipadreesen and macadressen and much more.

1141 Connected USB devices

1142 ATB connection

1143 no information without serial connection

1144 tone becomes quieter

1145 Provider status, SMS status

1146 Download status

Hope this would help:cool:
 
  • Like
Reactions: BobM2019

MitchtheMitch

Member
Sep 28, 2019
10
0
0
Peugeot Naceur wave 2Continental Serial Connection

With TX and Rx it is possible to get in the serial console of the head unit.

But it asks for a login and password.

Imx6x-std login:
Password:

Tried a lot of things, like root and pass.

Left pass empty but nothing works.

Anybody a clue?