hacking nac peugeot

ianna

Member
Mar 2, 2009
14
2
0
HI guys, I've a new 3008 Allure version and i want to enable the iCockpit color personalization how to GT Line model. Is it possible? I think and hope yes
 

horuscurcino

Member
Oct 30, 2010
31
19
28
Sao Paulo/SP
The pins at on the middle connector.

It should be the yellow part wich is in the middle of the connector.

Pin 23 and 24
And
Pin 29 and 30

Regards
Thank you. They are the same on the BOSCH RCC unit but they dont give a proper output. Perhaps it is a fault of my TTL device. I was testing in the continental NAC unit and found two interesting things:

first, the boot text shows the path of the development folders
Code:
sh[3691]: OIPBI: Used SDK (Toolchain): /PROJ/oip/SDK/MG_20170106_M11_7.0.165p/MV_Tools
sh[3691]: OIPBI: Used Mirror:          /PROJ/oip/PDK/20170613_PDK_11.00.120.03/Mirror/solutions/com.continental/MV_PINT
And also says:

Code:
sh[3691]: OIPBI: Machine: Linux radfmxyu 3.13.0-106-generic #153~precise1-Ubuntu SMP Tue Dec 6 16:12:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build Info
sh[3691]: OIPBI:
sh[3691]: OIPBI: Builder: uidg6656
sh[3691]: OIPBI: Built:   jeudi 15 juin 2017, 12:28:06 (UTC+0200)
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build BL #Version: NAC_SOC_SYS_65.05.24.32_RCC #1
I think the username we need to explore is "uidg6656" and the path to find the password (or a hint of it) can be found on the firmware files. Linux usually stores passwords onto a file called "passwd" in "/etc" folder. However it needs to be decrypted.

For your information, these are the fundamentals of the software we are trying to access: http://events17.linuxfoundation.org/sites/events/files/slides/PSA_GENIVI_aboard_-_ALS.pdf

And the opensource software codes used on those units:
https://www.groupe-psa.com/en/oss/
 
Last edited:

apol

Member
Apr 1, 2006
17
2
0
Thank you. They are the same on the BOSCH RCC unit but they dont give a proper output. Perhaps it is a fault of my TTL device. I was testing in the continental NAC unit and found two interesting things:

first, the boot text shows the path of the development folders
Code:
sh[3691]: OIPBI: Used SDK (Toolchain): /PROJ/oip/SDK/MG_20170106_M11_7.0.165p/MV_Tools
sh[3691]: OIPBI: Used Mirror:          /PROJ/oip/PDK/20170613_PDK_11.00.120.03/Mirror/solutions/com.continental/MV_PINT
And also says:

Code:
sh[3691]: OIPBI: Machine: Linux radfmxyu 3.13.0-106-generic #153~precise1-Ubuntu SMP Tue Dec 6 16:12:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build Info
sh[3691]: OIPBI:
sh[3691]: OIPBI: Builder: uidg6656
sh[3691]: OIPBI: Built:   jeudi 15 juin 2017, 12:28:06 (UTC+0200)
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build BL #Version: NAC_SOC_SYS_65.05.24.32_RCC #1
I think the username we need to explore is "uidg6656" and the path to find the password (or a hint of it) can be found on the firmware files. Linux usually stores passwords onto a file called "passwd" in "/etc" folder. However it needs to be decrypted.

For your information, these are the fundamentals of the software we are trying to access: http://events17.linuxfoundation.org/sites/events/files/slides/PSA_GENIVI_aboard_-_ALS.pdf

And the opensource software codes used on those units:
https://www.groupe-psa.com/en/oss/
can you point the rs in rcc connector

interesting here about RCC unit is possible to connect via sub2lan https://fccid.io/YBN-PSARCCA100/Use...hnical-Passport-3119654/ViewExhibitReport.cfm
 
Last edited:

horuscurcino

Member
Oct 30, 2010
31
19
28
Sao Paulo/SP
For RCC is the same as MitchtheMitch said. Look in the document you posted there are "debug" lines on these pins. By the way, the LAN connection was not possible here using USB to Ethernet adapters (tried 3 different models/vendors). I think bosch submit to the test center an unlocked unit to make the certification tests possible.

Found this on "passwd" file from NAC firmware.
It shows all the registered users for this unit to use the linux environment
The structure says:
USER:X or * if a password is assigned:user directory
Code:
root::0:0:root:/home/root:/bin/sh
daemon:*:1:1:daemon:/usr/sbin:/bin/sh
bin:*:2:2:bin:/bin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
sync:*:4:65534:sync:/bin:/bin/sync
games:*:5:60:games:/usr/games:/bin/sh
man:*:6:12:man:/var/cache/man:/bin/sh
lp:*:7:7:lp:/var/spool/lpd:/bin/sh
mail:*:8:8:mail:/var/mail:/bin/sh
news:*:9:9:news:/var/spool/news:/bin/sh
uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:*:13:13:proxy:/bin:/bin/sh
www-data:*:33:33:www-data:/var/www:/bin/sh
backup:*:34:34:backup:/var/backups:/bin/sh
list:*:38:38:Mailing List Manager:/var/list:/bin/sh
irc:*:39:39:ircd:/var/run/ircd:/bin/sh
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
xuser:x:100:101:Linux User,,,:/tmp:/bin/sh
messagebus:x:101:103:Linux User,,,:/var/lib/dbus:/bin/false
pulse:x:102:1000:Linux User,,,:/tmp/home/pulse/:/bin/false
polkituser:x:104:1002:polkituser:/var/run/polkit:/bin/false
Org:x:0:0:org.genivi.NodeStartupController1:/:/bin/false
SerGet:x:0:0:[email protected]:/:/bin/false
sysdquot:x:0:0:systemd-quotacheck:/:/bin/false
dbuspub:x:10678:10678:dbus-public-bus:/:/bin/false
Dbu:x:0:0:dbus:/:/bin/false
dbssess:x:0:0:mm-dbus-session:/:/bin/false
rngd:x:10100:10100:rngd:/:/bin/false
hkdiag:x:10041:10041:diag-svc-plf-coding-daemon:/:/bin/false
rescue:x:0:0:rescue:/:/bin/false
console:x:0:0:[email protected]:/:/bin/false
systime:x:10014:10014:restore-system-time:/:/bin/false
quotaon:x:0:0:quotaon:/:/bin/false
persist:x:0:0:pas-daemon:/:/bin/false
persVlow:x:10090:10090:vlow-container-svc-daemon:/:/bin/false
systemd:x:0:0:systemd-exit:/:/bin/false
lcnsm:x:10010:10010:node state manager:/:/bin/false
lcnsc:x:10012:10012:node state manager:/:/bin/false
lcnhm:x:10567:10567:node-health-monitor:/:/bin/false
audmgr:x:14573:14573:media-audiomanager:/tmp/:/bin/false
audpls:x:10020:10020:pulseaudio:/var/run/pulse:/bin/false
audalsa:x:10573:10573:alsa-state:/:/bin/false
audsnd:x:10311:10311:media-soundgen-ref:/tmp:/bin/false
media:x:10030:10030:oip-media-timeshift:/tmp:/bin/false
video:x:10222:10222:splash:/:/bin/false
contel:x:10040:10040:oip-pi-telephonyservice:/:/bin/false
concb:x:10039:10039:oip-pi-contactbook:/:/bin/false
conmsg:x:10038:10038:oip-pi-messaging:/:/bin/false
conml:x:10053:10053:oip-pi-mirrorlink:/:/bin/false
conbrw:x:10037:10037:oip-pi-wbf:/:/bin/false
concm:x:0:0:connman:/:/bin/false
conwf:x:0:0:wifi:/:/bin/false
conusb:x:10001:10001:usbmgr:/:/bin/false
conbt:x:10042:10042:bluetooth:/:/bin/false
conphnpl:x:0:0:oip-pi-phoneplugin:/:/bin/false
swlman:x:0:0:swl-manager:/:/bin/false
mchineid:x:0:0:machineid:/:/bin/false
Key:x:0:0:keyprovider:/:/bin/false
udisks:x:0:0:udisks-daemon:/:/bin/false
persftop:x:0:0:top:/:/bin/false
firewall:x:0:0:iptables:/:/bin/false
graphic:x:10501:10501:wayland:/:/bin/false
ltsyslog:x:0:0:syslog-ng:/:/bin/false
ltdlt:x:10006:10006:dlt:/:/bin/false
ltdltsys:x:10007:10007:dlt:/:/bin/false
ltdltprint:x:10008:10008:dlt:/:/bin/false
persubi:x:0:0:ubi-attach2:/:/bin/false
NhmRec:x:0:0:nhm-recovery:/:/bin/false
NrmRec:x:0:0:nrm-recovery:/:/bin/false
VloSvcRec:x:0:0:vlow-svc-recovery:/:/bin/false
inptouchcal:x:0:0:oip-ssw-touch-calibration:/:/bin/false
slwmdutl:x:0:0:SWLD user:/:/bin/false
swlopkg:x:0:0:SWLD user opkg:/:/bin/false
SysUpdUtmShu:x:0:0:user update:/:/bin/false
conhfc:x:10568:10568:Handsfree Service:/:/bin/false
usbmux:*:10570:10570::/:/bin/false
concedc:*:10571:10571::/:/bin/false
lcnrm:*:10572:10572::/:/bin/false
fws:*:10573:10573::/:/bin/false
radio:*:10575:10575::/:/bin/false
i2c:*:10578:10578::/:/bin/false
infdat:*:10580:10580::/:/bin/false
phm-fsuc:*:10582:10569:phm-fsuc:/:/bin/false
persNba:*:10587:10587:Pers - NBA daemon:/:/bin/false
persVlow:*:10589:10589:Pers - Vlow container daemon:/:/bin/false
persHwi:*:10590:10590:Pers - HWInfo container daemon:/:/bin/false
persErly:*:10591:10591:Pers - EarlyData container daemon:/:/bin/false
persScrd:*:10592:10592:Pers - SecuredData container daemon:/:/bin/false
persIio:*:10594:10594:Pers - ImageIO ():/:/bin/false
condhcp:*:10596:10596:Conectivity DHCP daemon:/tmp:/bin/false
conaap:*:10598:10598:oip-connsvc-androidauto:/:/bin/false
usrprfmgr:*:10599:10599:User Profile Manager:/tmp:/bin/false
The only one not assigned as you can see is root user. But anyway it gaves me errors when trying to log in without password.

Unfortunately i cannot find the "shadows" file where the passwords are supposed to be stored in.
Found another file saying the password for some instance is "files" without quotes. Can you test it for those usernames?
 
Last edited:
  • Like
Reactions: MitchtheMitch

MitchtheMitch

Member
Sep 28, 2019
10
0
0
For RCC is the same as MitchtheMitch said. Look in the document you posted there are "debug" lines on these pins. By the way, the LAN connection was not possible here using USB to Ethernet adapters (tried 3 different models/vendors). I think bosch submit to the test center an unlocked unit to make the certification tests possible.

Found this on "passwd" file from NAC firmware.
It shows all the registered users for this unit to use the linux environment
The structure says:
USER:X or * if a password is assigned:user directory
Code:
root::0:0:root:/home/root:/bin/sh
daemon:*:1:1:daemon:/usr/sbin:/bin/sh
bin:*:2:2:bin:/bin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
sync:*:4:65534:sync:/bin:/bin/sync
games:*:5:60:games:/usr/games:/bin/sh
man:*:6:12:man:/var/cache/man:/bin/sh
lp:*:7:7:lp:/var/spool/lpd:/bin/sh
mail:*:8:8:mail:/var/mail:/bin/sh
news:*:9:9:news:/var/spool/news:/bin/sh
uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:*:13:13:proxy:/bin:/bin/sh
www-data:*:33:33:www-data:/var/www:/bin/sh
backup:*:34:34:backup:/var/backups:/bin/sh
list:*:38:38:Mailing List Manager:/var/list:/bin/sh
irc:*:39:39:ircd:/var/run/ircd:/bin/sh
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
xuser:x:100:101:Linux User,,,:/tmp:/bin/sh
messagebus:x:101:103:Linux User,,,:/var/lib/dbus:/bin/false
pulse:x:102:1000:Linux User,,,:/tmp/home/pulse/:/bin/false
polkituser:x:104:1002:polkituser:/var/run/polkit:/bin/false
Org:x:0:0:org.genivi.NodeStartupController1:/:/bin/false
SerGet:x:0:0:[email protected]:/:/bin/false
sysdquot:x:0:0:systemd-quotacheck:/:/bin/false
dbuspub:x:10678:10678:dbus-public-bus:/:/bin/false
Dbu:x:0:0:dbus:/:/bin/false
dbssess:x:0:0:mm-dbus-session:/:/bin/false
rngd:x:10100:10100:rngd:/:/bin/false
hkdiag:x:10041:10041:diag-svc-plf-coding-daemon:/:/bin/false
rescue:x:0:0:rescue:/:/bin/false
console:x:0:0:[email protected]:/:/bin/false
systime:x:10014:10014:restore-system-time:/:/bin/false
quotaon:x:0:0:quotaon:/:/bin/false
persist:x:0:0:pas-daemon:/:/bin/false
persVlow:x:10090:10090:vlow-container-svc-daemon:/:/bin/false
systemd:x:0:0:systemd-exit:/:/bin/false
lcnsm:x:10010:10010:node state manager:/:/bin/false
lcnsc:x:10012:10012:node state manager:/:/bin/false
lcnhm:x:10567:10567:node-health-monitor:/:/bin/false
audmgr:x:14573:14573:media-audiomanager:/tmp/:/bin/false
audpls:x:10020:10020:pulseaudio:/var/run/pulse:/bin/false
audalsa:x:10573:10573:alsa-state:/:/bin/false
audsnd:x:10311:10311:media-soundgen-ref:/tmp:/bin/false
media:x:10030:10030:oip-media-timeshift:/tmp:/bin/false
video:x:10222:10222:splash:/:/bin/false
contel:x:10040:10040:oip-pi-telephonyservice:/:/bin/false
concb:x:10039:10039:oip-pi-contactbook:/:/bin/false
conmsg:x:10038:10038:oip-pi-messaging:/:/bin/false
conml:x:10053:10053:oip-pi-mirrorlink:/:/bin/false
conbrw:x:10037:10037:oip-pi-wbf:/:/bin/false
concm:x:0:0:connman:/:/bin/false
conwf:x:0:0:wifi:/:/bin/false
conusb:x:10001:10001:usbmgr:/:/bin/false
conbt:x:10042:10042:bluetooth:/:/bin/false
conphnpl:x:0:0:oip-pi-phoneplugin:/:/bin/false
swlman:x:0:0:swl-manager:/:/bin/false
mchineid:x:0:0:machineid:/:/bin/false
Key:x:0:0:keyprovider:/:/bin/false
udisks:x:0:0:udisks-daemon:/:/bin/false
persftop:x:0:0:top:/:/bin/false
firewall:x:0:0:iptables:/:/bin/false
graphic:x:10501:10501:wayland:/:/bin/false
ltsyslog:x:0:0:syslog-ng:/:/bin/false
ltdlt:x:10006:10006:dlt:/:/bin/false
ltdltsys:x:10007:10007:dlt:/:/bin/false
ltdltprint:x:10008:10008:dlt:/:/bin/false
persubi:x:0:0:ubi-attach2:/:/bin/false
NhmRec:x:0:0:nhm-recovery:/:/bin/false
NrmRec:x:0:0:nrm-recovery:/:/bin/false
VloSvcRec:x:0:0:vlow-svc-recovery:/:/bin/false
inptouchcal:x:0:0:oip-ssw-touch-calibration:/:/bin/false
slwmdutl:x:0:0:SWLD user:/:/bin/false
swlopkg:x:0:0:SWLD user opkg:/:/bin/false
SysUpdUtmShu:x:0:0:user update:/:/bin/false
conhfc:x:10568:10568:Handsfree Service:/:/bin/false
usbmux:*:10570:10570::/:/bin/false
concedc:*:10571:10571::/:/bin/false
lcnrm:*:10572:10572::/:/bin/false
fws:*:10573:10573::/:/bin/false
radio:*:10575:10575::/:/bin/false
i2c:*:10578:10578::/:/bin/false
infdat:*:10580:10580::/:/bin/false
phm-fsuc:*:10582:10569:phm-fsuc:/:/bin/false
persNba:*:10587:10587:Pers - NBA daemon:/:/bin/false
persVlow:*:10589:10589:Pers - Vlow container daemon:/:/bin/false
persHwi:*:10590:10590:Pers - HWInfo container daemon:/:/bin/false
persErly:*:10591:10591:Pers - EarlyData container daemon:/:/bin/false
persScrd:*:10592:10592:Pers - SecuredData container daemon:/:/bin/false
persIio:*:10594:10594:Pers - ImageIO ():/:/bin/false
condhcp:*:10596:10596:Conectivity DHCP daemon:/tmp:/bin/false
conaap:*:10598:10598:oip-connsvc-androidauto:/:/bin/false
usrprfmgr:*:10599:10599:User Profile Manager:/tmp:/bin/false
The only one not assigned as you can see is root user. But anyway it gaves me errors when trying to log in without password.

Unfortunately i cannot find the "shadows" file where the passwords are supposed to be stored in.
Found another file saying the password for some instance is "files" without quotes. Can you test it for those usernames?
Pretty good work!

So you set following:

Login: x
password: passwd

Is that correct?

Like you, I did try to connect it via USB and serial and telnet but without success.

Regards
 

rui.saraiva

Member
Apr 4, 2020
10
5
3
Lisbon
An old NAC Wave 2 firmware version 21.05.65.32 (early 2017), was wrongly released without any encryption. It was pulled some hours later, but it was a bit too late... I've the full update .tar file, but here's some of the interesting files, including the root filesystem, after converting/extracting - https drive (dot) google (dot) com (slash) open?id=1ocCo5WJheeBkChpydxkE1Q28UYh0Xjq9
 

horuscurcino

Member
Oct 30, 2010
31
19
28
Sao Paulo/SP
An old NAC Wave 2 firmware version 21.05.65.32 (early 2017), was wrongly released without any encryption. It was pulled some hours later, but it was a bit too late... I've the full update .tar file, but here's some of the interesting files, including the root filesystem, after converting/extracting - https drive (dot) google (dot) com (slash) open?id=1ocCo5WJheeBkChpydxkE1Q28UYh0Xjq9
Thank you, Rui ! It will certainly help on our research.
Muito obrigado!

Early chinese versions have the same security flaw.
www(dot)chengzhidan(dot)com(slash)auto(slash)NAC22-new(dot)rar
yadi(dot)sk(slash)d(slash)2kUiXTSOqoGoUA
 
Last edited:

NooBtheNoob

Member
Oct 31, 2019
5
1
3
Thank you, Rui ! It will certainly help on our research.
Muito obrigado!

Early chinese versions have the same security flaw.
www(dot)chengzhidan(dot)com(slash)auto(slash)NAC22-new(dot)rar
yadi(dot)sk(slash)d(slash)2kUiXTSOqoGoUA
Thir link does not work.

Thanks to Rui for the other link, maybe it will help more.

horuscurino, could you explain which parameters you set as Login name and password to extract the firmware darta?

i think somebody asked you allready before.

thank you :cool:
 
  • Like
Reactions: MitchtheMitch

Crunchy_Nuts

Member
Apr 9, 2018
9
5
0
It is also possible to copy the spylogs directly to usb with these commands

engineering_mode=1
create_spy=1
sync_spies_with_usb=1

You just have to create a file called "id" without file ending and put it on your usb stick in the root directory.

You may also need a "id=xxxx" commmand in the "id" file. (xxxx = a long id number needed)

Maybe there are more commands for usb.

---------- Post added at 12:39 PM ---------- Previous post was at 12:23 PM ----------

And here are the Cheatcodes & informations (maybe not all codes, who knows)


#Main configuration options

[Options]
spiespath = /mnt/mmc_ovip_rw/media/datastore_rw/var/local/sem/spy #path where to store the spies folder
corespath = /mnt/mmc_ovip_rw/media/datastore_rw/var/local/sem/cores #path where the core dump pool is located
version = 1.1.7

[general]
# Bypass audio processing cheatcode
BypassON_cheatcode=1144

# Restore audio processing cheatcode
BypassOFF_cheatcode=1155

# Cheatcodes
# Defined as options:
#
# [cc:cheatcodename]
#
# They basically have 4 configurable options: type, mons, spies, code. All must be set in order for the cheatcode to be valid.
# 'type' defines the cheatcode type. Can be one of: GENERIC,DIAGNOSTIC,HMI,AUDIO,CONECTIVITY,MEDIA,NAV,PHONE,RADIO,SSW,SWL,VEHICLE,SERVICES,APPFMK.
# 'mons' and 'spies' set the ID of the properties that are monitored and spied with this cheatcode. i.e:
#
# mons=1,2,3,4,5,6,7
# spies=1,2,3,4
#
# 'code' defines the code of this cheat code, required for activaion. i.e:
#
# code=abcdef
[cc:VUC]
type=SSW
code=1130
mons=0x1, \ #SEM_VUC_TEMP_POWERAMP
0x2, \ #SEM_VUC_TEMP_MOTHERBOARD
0x3, \ #SEM_VUC_LC_STATE
0x4, \ #SEM_VUC_SYSTEM_MANAGER_STATE
0x5, \ #SEM_VUC_POWER_MANAGER_STATE
0x6, \ #SEM_VUC_VLOW_STATE
0x7, \ #SEM_VUC_CAN_LIFE_PHASE
0x8, \ #SEM_VUC_CAN_CONTACT_STAT
0x9, \ #SEM_VUC_ECO_MODE
0xA, \ #SEM_VUC_LC_PHONE_STATE
0xB, \ #SEM_VUC_ERR_REBOOT_COUNT
0xC, \ #SEM_VUC_LAST_START_REASON
0xD, \ #SEM_VUC_POWERAMP_STATE
0xE, \ #SEM_VUC_FAN_STATE
0xF, \ #SEM_VUC_CPU_LOAD
0x10, \ #SEM_VUC_CURRENT_DIAG_SESSION
0x11, \ #SEM_VUC_RTP_RESYNC_RAP
0x12, \ #SEM_VUC_RTP_RESYNC_SOC
0x13, \ #SEM_VUC_RTP_FRAME_ERR_RAP
0x14, \ #SEM_VUC_RTP_FRAME_ERR_SOC
0x15, \ #SEM_VUC_CALIBRATION_REFERENCE
0x16, \ #SEM_VUC_DIAGNOSTIC_FLAGS
0x17, \ #SEM_VUC_DTC_LIST
0x18, \ #SEM_VUC_CAN_VERSION
0x19 #SEM_VUC_HARDWARE_VERSION
spies=0x1, \ #SEM_VUC_TEMP_POWERAMP
0x2, \ #SEM_VUC_TEMP_MOTHERBOARD
0x3, \ #SEM_VUC_LC_STATE
0x4, \ #SEM_VUC_SYSTEM_MANAGER_STATE
0x5, \ #SEM_VUC_POWER_MANAGER_STATE
0x6, \ #SEM_VUC_VLOW_STATE
0x7, \ #SEM_VUC_CAN_LIFE_PHASE
0x8, \ #SEM_VUC_CAN_CONTACT_STAT
0x9, \ #SEM_VUC_ECO_MODE
0xA, \ #SEM_VUC_LC_PHONE_STATE
0xB, \ #SEM_VUC_ERR_REBOOT_COUNT
0xC, \ #SEM_VUC_LAST_START_REASON
0xD, \ #SEM_VUC_POWERAMP_STATE
0xE, \ #SEM_VUC_FAN_STATE
0xF, \ #SEM_VUC_CPU_LOAD
0x10, \ #SEM_VUC_CURRENT_DIAG_SESSION
0x11, \ #SEM_VUC_RTP_RESYNC_RAP
0x12, \ #SEM_VUC_RTP_RESYNC_SOC
0x13, \ #SEM_VUC_RTP_FRAME_ERR_RAP
0x14, \ #SEM_VUC_RTP_FRAME_ERR_SOC
0x15, \ #SEM_VUC_CALIBRATION_REFERENCE
0x16, \ #SEM_VUC_DIAGNOSTIC_FLAGS
0x17, \ #SEM_VUC_DTC_LIST
0x18, \ #SEM_VUC_CAN_VERSION
0x19 #SEM_VUC_HARDWARE_VERSION

# For Wave 2, RAP is no more available
#[cc:RAP]
#type=SSW
#code=1131
#mons=0x100 #SEM_RAP_LC_STATE
#spies=0x100 #SEM_RAP_LC_STATE

[cc:SEM]
type=SSW
code=1138
mons=0x200, \ #SEM_OWN_TOTAL_SOC_LOAD
0x201, \ #SEM_OWN_REBOOT_COUNT
0x202, \ #SEM_OWN_USB_DETAILS
0x203, \ #SEM_OWN_DOMAIN_CPU_LOAD
0x204, \ #SEM_OWN_DOMAIN_RAM_USAGE
0x205, \ #SEM_OWN_FIRMWARE_VERSION
0x206, \ #SEM_OWN_OVERALL_SW_VERSION
0x207, \ #SEM_OWN_SOC_SW_VERSION
0x208, \ #SEM_OWN_SOC_PDK_VERSION
0x209, \ #SEM_OWN_VUC_SW_VERSION
0x20A, \ #SEM_OWN_DAB_SW_VERSION
0x20B, \ #SEM_OWN_HARDWARE_VARIANT
0x20C, \ #SEM_OWN_DISPLAY_VARIANT
0x20D, \ #SEM_OWN_BT_MAC_ADDRESS
0x20E, \ #SEM_OWN_WIFI_MAC_ADDRESS
0x20F, \ #SEM_OWN_CUSTOMER_VERSION
0x210 #SEM_OWN_CUSTOMER_RELEASE_DATE

spies=0x200, \ #SEM_OWN_TOTAL_SOC_LOAD
0x201, \ #SEM_OWN_REBOOT_COUNT
0x202, \ #SEM_OWN_USB_DETAILS
0x203, \ #SEM_OWN_DOMAIN_CPU_LOAD
0x204, \ #SEM_OWN_DOMAIN_RAM_USAGE
0x205, \ #SEM_OWN_FIRMWARE_VERSION
0x206, \ #SEM_OWN_OVERALL_SW_VERSION
0x207, \ #SEM_OWN_SOC_SW_VERSION
0x208, \ #SEM_OWN_SOC_PDK_VERSION
0x209, \ #SEM_OWN_VUC_SW_VERSION
0x20A, \ #SEM_OWN_DAB_SW_VERSION
0x20B, \ #SEM_OWN_HARDWARE_VARIANT
0x20C, \ #SEM_OWN_DISPLAY_VARIANT
0x20D, \ #SEM_OWN_BT_MAC_ADDRESS
0x20E, \ #SEM_OWN_WIFI_MAC_ADDRESS
0x20F, \ #SEM_OWN_CUSTOMER_VERSION
0x210 #SEM_OWN_CUSTOMER_RELEASE_DATE

[cc:Lifecycle]
type=SSW
code=1137
mons=0xA000, \ #SEM_LC_CURRENT_STATE
0xA001, \ #SEM_LC_HMI_STATE
0xA002, \ #SEM_LC_APP_STATE
0xA003, \ #SEM_LC_PHONE_STATE
0xA004, \ #SEM_LC_SUPPLY_STATE
0xA005, \ #SEM_LC_PRODUCT_STATE
0xA006, \ #SEM_LC_POPUP_STATE
0xA007 #SEM_LC_TEMPERATURE
spies=0xA000, \ #SEM_LC_CURRENT_STATE
0xA001, \ #SEM_LC_HMI_STATE
0xA002, \ #SEM_LC_APP_STATE
0xA003, \ #SEM_LC_PHONE_STATE
0xA004, \ #SEM_LC_SUPPLY_STATE
0xA005, \ #SEM_LC_PRODUCT_STATE
0xA006, \ #SEM_LC_POPUP_STATE
0xA007 #SEM_LC_TEMPERATURE

[cc:Radio]
type=RADIO
code=1133
mons=0xAB00, \ #SEM_RAD_SPY_RDS_QUALITY
0xAB01, \ #SEM_RAD_ETM_TUNER_AM
0xAB02, \ #SEM_RAD_ETM_TUNER_FM
0xAB03, \ #SEM_RAD_ETM_TUNER_DAB
0xAB04, \ #SEM_RAD_ETM_AF_FM
0xAB05, \ #SEM_RAD_ETM_AF_DAB
0xAB06, \ #SEM_RAD_ETM_ALT_PI
0xAB07, \ #SEM_RAD_ETM_ANTENNAS_FM
0xAB08, \ #SEM_RAD_ETM_ANTENNAS_DAB
0xAB09 #SEM_RAD_ETM_TUNER_TMC
spies=0xAB00, \ #SEM_RAD_SPY_RDS_QUALITY
0xAB01, \ #SEM_RAD_ETM_TUNER_AM
0xAB02, \ #SEM_RAD_ETM_TUNER_FM
0xAB03, \ #SEM_RAD_ETM_TUNER_DAB
0xAB04, \ #SEM_RAD_ETM_AF_FM
0xAB05, \ #SEM_RAD_ETM_AF_DAB
0xAB06, \ #SEM_RAD_ETM_ALT_PI
0xAB07, \ #SEM_RAD_ETM_ANTENNAS_FM
0xAB08, \ #SEM_RAD_ETM_ANTENNAS_DAB
0xAB09 #SEM_RAD_ETM_TUNER_TMC

[cc:Speech]
type=SPEECH
code=1135
mons=0xAC00, \ #SEM_SPC_VOICEID
0xAC01, \ #SEM_SPC_TTS_VERSION
0xAC02 #SEM_SPC_VR_VERSION
spies=0xAC00, \ #SEM_SPC_VOICEID
0xAC01, \ #SEM_SPC_TTS_VERSION
0xAC02 #SEM_SPC_VR_VERSION

[cc:WIFI]
type=CONNECTIVITY
code=1136
mons=0xAD0E, \ #SEM_CONN_WIFI_DEVICE_IPADDR_VALUE
0xAD0F, \ #SEM_CONN_WIFI_CHIP_VERSION_VALUE
0xAD10, \ #SEM_CONN_WIFI_STATUS
0xAD11, \ #SEM_CONN_WIFI_AP_STATUS
0xAD12, \ #SEM_CONN_WIFI_STA_LIST_VALUE
0xAD13, \ #SEM_CONN_WIFI_PERSISTENCE_VALUES
0xAD14 #SEM_CONN_WIFI_LAST_ERROR_REPORTED
spies=0xAD0E, \ #SEM_CONN_WIFI_DEVICE_IPADDR_VALUE
0xAD0F, \ #SEM_CONN_WIFI_CHIP_VERSION_VALUE
0xAD10, \ #SEM_CONN_WIFI_STATUS
0xAD11, \ #SEM_CONN_WIFI_AP_STATUS
0xAD12, \ #SEM_CONN_WIFI_STA_LIST_VALUE
0xAD13, \ #SEM_CONN_WIFI_PERSISTENCE_VALUES
0xAD14 #SEM_CONN_WIFI_LAST_ERROR_REPORTED
[cc:Bluetooth]
type=CONNECTIVITY
code=1132
mons=0xAD00, \ #SEM_CONN_BT_PAIRED_DEVICE1
0xAD01, \ #SEM_CONN_BT_PAIRED_DEVICE2
0xAD02, \ #SEM_CONN_BT_PAIRED_DEVICE3
0xAD03, \ #SEM_CONN_BT_PAIRED_DEVICE4
0xAD04, \ #SEM_CONN_BT_PAIRED_DEVICE5
0xAD05, \ #SEM_CONN_BT_PAIRED_DEVICE6
0xAD06, \ #SEM_CONN_BT_PAIRED_DEVICE7
0xAD07, \ #SEM_CONN_BT_PAIRED_DEVICE8
0xAD08, \ #SEM_CONN_BT_PAIRED_DEVICE9
0xAD09, \ #SEM_CONN_BT_PAIRED_DEVICE10
0xAD0A, \ #SEM_CONN_BT_DEVICE_CONN_HISTORY
0xAD0B, \ #SEM_CONN_BT_LOCAL_DEVICE_INFO
0xAD0C, \ #SEM_CONN_BT_SERVICE_STATUS
0xAD0D #SEM_CONN_BT_PERSISTANCY_KEYS
spies=0xAD00, \ #SEM_CONN_BT_PAIRED_DEVICE1
0xAD01, \ #SEM_CONN_BT_PAIRED_DEVICE2
0xAD02, \ #SEM_CONN_BT_PAIRED_DEVICE3
0xAD03, \ #SEM_CONN_BT_PAIRED_DEVICE4
0xAD04, \ #SEM_CONN_BT_PAIRED_DEVICE5
0xAD05, \ #SEM_CONN_BT_PAIRED_DEVICE6
0xAD06, \ #SEM_CONN_BT_PAIRED_DEVICE7
0xAD07, \ #SEM_CONN_BT_PAIRED_DEVICE8
0xAD08, \ #SEM_CONN_BT_PAIRED_DEVICE9
0xAD09, \ #SEM_CONN_BT_PAIRED_DEVICE10
0xAD0A, \ #SEM_CONN_BT_DEVICE_CONN_HISTORY
0xAD0B, \ #SEM_CONN_BT_LOCAL_DEVICE_INFO
0xAD0C, \ #SEM_CONN_BT_SERVICE_STATUS
0xAD0D #SEM_CONN_BT_PERSISTANCY_KEYS

[cc:ConnMgr]
type=CONNECTIVITY
code=1140
mons=0xAD15, \ #SEM_CONN_CM_SRV_ORDER
0xAD16, \ #SEM_CONN_CM_SRV_PROPERTIES
0xAD17, \ #SEM_CONN_CM_SRV_PROPERTY_CHG
0xAD18, \ #SEM_CONN_CM_DATA_USAGE_CURR_SRV
0xAD19, \ #SEM_CONN_CM_DATA_USAGE_ATB
0xAD1A, \ #SEM_CONN_CM_DATA_USAGE_WIFI
0xAD1B, \ #SEM_CONN_CM_DATA_USAGE_USB
0xAD1C, \ #SEM_CONN_CM_DATA_USAGE_BT
0xAD1D, \ #SEM_CONN_CM_ROUTING_TABLE
0xAD1E, \ #SEM_CONN_CM_TETHERING_STATE
0xAD1F, \ #SEM_CONN_CM_ATB_CONNECTED_APPS
0xAD20, \ #SEM_CONN_CM_LAST_ERROR
0xAD21, \ #SEM_CONN_CM_WIFI_UPLOAD_RATE
0xAD22, \ #SEM_CONN_CM_WIFI_DOWNLOAD_RATE
0xAD23, \ #SEM_CONN_CM_GSM_UPLOAD_RATE
0xAD24, \ #SEM_CONN_CM_GSM_DOWNLOAD_RATE
0xAD25, \ #SEM_CONN_CM_BT_UPLOAD_RATE
0xAD26, \ #SEM_CONN_CM_BT_DOWNLOAD_RATE
0xAD27, \ #SEM_CONN_CM_USB_UPLOAD_RATE
0xAD28, \ #SEM_CONN_CM_USB_DOWNLOAD_RATE
0xAD29, \ #SEM_CONN_CM_REMOTE_CONNECTED_DEVICE_IPADDR
0xAD2A, \ #SEM_CONN_CM_CURRENT_UPLOAD_RATE
0xAD2B, \ #SEM_CONN_CM_CURRENT_DOWNLOAD_RATE
0xAD2C, \ #SEM_CONN_CM_CONNECTIVITY_TYPE
0xAD2D, \ #SEM_CONN_CM_ATB_PRESENCE_STATUS
0xAD2E, \ #SEM_CONN_CM_ATB_CONNECTION_STATUS
0xAD2F, \ #SEM_CONN_CM_ATB_BUSY_STATUS
0xAD30, \ #SEM_CONN_CM_DEFAULT_GATEWAY_OBJECT_PATH
0xAD31 #SEM_CONN_CM_COUNT_TELEMATIC_LINK_APPLICATIONS
spies=0xAD15, \ #SEM_CONN_CM_SRV_ORDER
0xAD16, \ #SEM_CONN_CM_SRV_PROPERTIES
0xAD17, \ #SEM_CONN_CM_SRV_PROPERTY_CHG
0xAD18, \ #SEM_CONN_CM_DATA_USAGE_CURR_SRV
0xAD19, \ #SEM_CONN_CM_DATA_USAGE_ATB
0xAD1A, \ #SEM_CONN_CM_DATA_USAGE_WIFI
0xAD1B, \ #SEM_CONN_CM_DATA_USAGE_USB
0xAD1C, \ #SEM_CONN_CM_DATA_USAGE_BT
0xAD1D, \ #SEM_CONN_CM_ROUTING_TABLE
0xAD1E, \ #SEM_CONN_CM_TETHERING_STATE
0xAD1F, \ #SEM_CONN_CM_ATB_CONNECTED_APPS
0xAD20, \ #SEM_CONN_CM_LAST_ERROR
0xAD21, \ #SEM_CONN_CM_WIFI_UPLOAD_RATE
0xAD22, \ #SEM_CONN_CM_WIFI_DOWNLOAD_RATE
0xAD23, \ #SEM_CONN_CM_GSM_UPLOAD_RATE
0xAD24, \ #SEM_CONN_CM_GSM_DOWNLOAD_RATE
0xAD25, \ #SEM_CONN_CM_BT_UPLOAD_RATE
0xAD26, \ #SEM_CONN_CM_BT_DOWNLOAD_RATE
0xAD27, \ #SEM_CONN_CM_USB_UPLOAD_RATE
0xAD28, \ #SEM_CONN_CM_USB_DOWNLOAD_RATE
0xAD29, \ #SEM_CONN_CM_REMOTE_CONNECTED_DEVICE_IPADDR
0xAD2A, \ #SEM_CONN_CM_CURRENT_UPLOAD_RATE
0xAD2B, \ #SEM_CONN_CM_CURRENT_DOWNLOAD_RATE
0xAD2C, \ #SEM_CONN_CM_CONNECTIVITY_TYPE
0xAD2D, \ #SEM_CONN_CM_ATB_PRESENCE_STATUS
0xAD2E, \ #SEM_CONN_CM_ATB_CONNECTION_STATUS
0xAD2F, \ #SEM_CONN_CM_ATB_BUSY_STATUS
0xAD30, \ #SEM_CONN_CM_DEFAULT_GATEWAY_OBJECT_PATH
0xAD31 #SEM_CONN_CM_COUNT_TELEMATIC_LINK_APPLICATIONS

[cc:USBM]
type=CONNECTIVITY
code=1141
mons=0xAD32, \ #SEM_CONN_USBM_DEVICE
0xAD33 #SEM_CONN_USBM_OVERVOLTAGE
spies=0xAD32, \ #SEM_CONN_USBM_DEVICE
0xAD33 #SEM_CONN_USBM_OVERVOLTAGE

[cc:TBM]
type=CONNECTIVITY
code=1142
mons=0xAD34, \ #SEM_CONN_TBM_CONNECTION_STATUS
0xAD35, \ #SEM_CONN_TBM_PRESENCE_STATUS
0xAD36, \ #SEM_CONN_TBM_BUSY_STATUS
0xAD37, \ #SEM_CONN_TBM_ATB_TELECO_STATUS
0xAD38, \ #SEM_CONN_TBM_USB_WARNING
0xAD39 #SEM_CONN_TBM_USB_ERROR
spies=0xAD34, \ #SEM_CONN_TBM_CONNECTION_STATUS
0xAD35, \ #SEM_CONN_TBM_PRESENCE_STATUS
0xAD36, \ #SEM_CONN_TBM_BUSY_STATUS
0xAD37, \ #SEM_CONN_TBM_ATB_TELECO_STATUS
0xAD38, \ #SEM_CONN_TBM_USB_WARNING
0xAD39 #SEM_CONN_TBM_USB_ERROR

[cc:phone]
type=CONNECTIVITY
code=1143
mons=0xAD3A, \ #SEM_CONN_PHONE_GSM_MCC
0xAD3B, \ #SEM_CONN_PHONE_GSM_MNC
0xAD3C, \ #SEM_CONN_PHONE_MANUFACTURER
0xAD3D, \ #SEM_CONN_PHONE_MODEL
0xAD3E, \ #SEM_CONN_PHONE_IMEI
0xAD3F #SEM_CONN_PHONE_SWVERSION
spies=0xAD3A, \ #SEM_CONN_PHONE_GSM_MCC
0xAD3B, \ #SEM_CONN_PHONE_GSM_MNC
0xAD3C, \ #SEM_CONN_PHONE_MANUFACTURER
0xAD3D, \ #SEM_CONN_PHONE_MODEL
0xAD3E, \ #SEM_CONN_PHONE_IMEI
0xAD3F #SEM_CONN_PHONE_SWVERSION

[cc:Cbook]
type=CONNECTIVITY
code=1146
mons=0xAD40, \ #SEM_CONN_CB_INIT_STATUS
0xAD41, \ #SEM_CONN_CB_SELECTION_DETAILS
0xAD42 #SEM_CONN_CB_OPERATION_DETAILS
spies=0xAD40, \ #SEM_CONN_CB_INIT_STATUS
0xAD41, \ #SEM_CONN_CB_SELECTION_DETAILS
0xAD42 #SEM_CONN_CB_OPERATION_DETAILS

[cc:Messaging]
type=CONNECTIVITY
code=1145
mons=0xAD43, \ #SEM_CONN_MSG_PROVIDER_SET
0xAD44, \ #SEM_CONN_MSG_PROVIDER_REMOVED
0xAD45, \ #SEM_CONN_MSG_NEW_MESSAGE_TEMPLATE
0xAD46, \ #SEM_CONN_MSG_EMAIL_SENT
0xAD47, \ #SEM_CONN_MSG_SMS_SENT
0xAD48, \ #SEM_CONN_MSG_EMAIL_DELETED
0xAD49 #SEM_CONN_MSG_SMS_DELETED
spies=0xAD43, \ #SEM_CONN_MSG_PROVIDER_SET
0xAD44, \ #SEM_CONN_MSG_PROVIDER_REMOVED
0xAD45, \ #SEM_CONN_MSG_NEW_MESSAGE_TEMPLATE
0xAD46, \ #SEM_CONN_MSG_EMAIL_SENT
0xAD47, \ #SEM_CONN_MSG_SMS_SENT
0xAD48, \ #SEM_CONN_MSG_EMAIL_DELETED
0xAD49 #SEM_CONN_MSG_SMS_DELETED

[cc:Nagivation]
type=NAV
code=1134
mons=0xAE00, \ #SEM_NAV_GPS_RECEPTION_QUALITY
0xAE01, \ #SEM_NAV_CAR_SPEED
0xAE02, \ #SEM_NAV_VISIBLE_SATELLITES
0xAE03, \ #SEM_NAV_RAW_GPS_POSSITION
0xAE04, \ #SEM_NAV_GUIDANCE_STATUS
0xAE05, \ #SEM_NAV_RELEASE_VERSION
0xAE06, \ #SEM_NAV_MAP_VERSION
0xAE07, \ #SEM_NAV_PERSISTENCY_DUMP
0xAE08, \ #SEM_NAV_EXPIRATION_DATES
0xAE09, \ #SEM_NAV_IDS
0xAE0A, \ #SEM_NAV_ACTIVE_ROUTE
0xAE0B, \ #SEM_NAV_MODULE_LOADER_PROGRESS
0xAE0C, \ #SEM_NAV_SCREEN_STACK
0xAE0D, \ #SEM_NAV_CONNECTION_STATUS
0xAE0E, \ #SEM_NAV_LANGUAGE
0xAE0F, \ #SEM_NAV_DR_SENSORS
0xAE10, \ #SEM_NAV_LANGUAGE_ENGINE
0xAE11 #SEM_NAV_GPS_FIRMWARE_VERSION
spies=0xAE00, \ #SEM_NAV_GPS_RECEPTION_QUALITY
0xAE01, \ #SEM_NAV_CAR_SPEED
0xAE02, \ #SEM_NAV_VISIBLE_SATELLITES
0xAE03, \ #SEM_NAV_RAW_GPS_POSSITION
0xAE04, \ #SEM_NAV_GUIDANCE_STATUS
0xAE05, \ #SEM_NAV_RELEASE_VERSION
0xAE06, \ #SEM_NAV_MAP_VERSION
0xAE07, \ #SEM_NAV_PERSISTENCY_DUMP
0xAE08, \ #SEM_NAV_EXPIRATION_DATES
0xAE09, \ #SEM_NAV_IDS
0xAE0A, \ #SEM_NAV_ACTIVE_ROUTE
0xAE0B, \ #SEM_NAV_MODULE_LOADER_PROGRESS
0xAE0C, \ #SEM_NAV_SCREEN_STACK
0xAE0D, \ #SEM_NAV_CONNECTION_STATUS
0xAE0E, \ #SEM_NAV_LANGUAGE
0xAE0F, \ #SEM_NAV_DR_SENSORS
0xAE10, \ #SEM_NAV_LANGUAGE_ENGINE
0xAE11 #SEM_NAV_GPS_FIRMWARE_VERSION

[cc:HMI]
type=HMI
code=1139
mons=0xAF00, \ #SEM_HMI_FPS_RATE
0xAF01, \ #SEM_HMI_GPU_LOAD
0xAF02, \ #SEM_HMI_HAND_WRITING_VERSION
0xAF03 #SEM_HMI_PIN_YIN_VERSION
spies=0xAF00, \ #SEM_HMI_FPS_RATE
0xAF01, \ #SEM_HMI_GPU_LOAD
0xAF02, \ #SEM_HMI_HAND_WRITING_VERSION
0xAF03 #SEM_HMI_PIN_YIN_VERSION
[cc:TSM]
type=CONNECTIVITY
code=1147
mons=0xAD4A, \ #SEM_CONN_TSM_LINK_STATUS
0xAD4B, \ #SEM_CONN_TSM_CONN_TIME
0xAD4C, \ #SEM_CONN_TSM_MACHINE_STATE
0xAD4D, \ #SEM_CONN_TSM_LINK_TRY_CNT
0xAD4E, \ #SEM_CONN_TSM_SEND_TRY_CNT
0xAD4F, \ #SEM_CONN_TSM_STARTUP_STATE
0xAD50, \ #SEM_CONN_TSM_ALL_REQ_CNT
0xAD51, \ #SEM_CONN_TSM_SMS_REQ_CNT
0xAD52, \ #SEM_CONN_TSM_FAILED_FORM_REQ_CNT
0xAD53, \ #SEM_CONN_TSM_OK_FORM_REQ_CNT
0xAD54, \ #SEM_CONN_TSM_FAILED_EXEC_REQ_CNT
0xAD55, \ #SEM_CONN_TSM_CURL_SEND_CNT
0xAD56, \ #SEM_CONN_TSM_LAST_REQ
0xAD57, \ #SEM_CONN_TSM_LAST_FAILED_FORM_REQ
0xAD58, \ #SEM_CONN_TSM_LAST_OK_FORM_REQ
0xAD59, \ #SEM_CONN_TSM_FAILED_EXEC_REQ
0xAD5A, \ #SEM_CONN_TSM_LAST_CURL_TIME
0xAD5B, \ #SEM_CONN_TSM_LAST_SERV_TIME
0xAD5C, \ #SEM_CONN_TSM_MSG_QUEUE_PROP
0xAD5D, \ #SEM_CONN_TSM_SRV_CHECK
0xAD5E, \ #SEM_CONN_TSM_CONN_REC
0xAD5F, \ #SEM_CONN_TSM_SEND_RET
0xAD60, \ #SEM_CONN_TSM_SEND_INTERVAL
0xAD61 #SEM_CONN_TSM_ADMIN_URL
spies=0xAD4A, \ #SEM_CONN_TSM_LINK_STATUS
0xAD4B, \ #SEM_CONN_TSM_CONN_TIME
0xAD4C, \ #SEM_CONN_TSM_MACHINE_STATE
0xAD4D, \ #SEM_CONN_TSM_LINK_TRY_CNT
0xAD4E, \ #SEM_CONN_TSM_SEND_TRY_CNT
0xAD4F, \ #SEM_CONN_TSM_STARTUP_STATE
0xAD50, \ #SEM_CONN_TSM_ALL_REQ_CNT
0xAD51, \ #SEM_CONN_TSM_SMS_REQ_CNT
0xAD52, \ #SEM_CONN_TSM_FAILED_FORM_REQ_CNT
0xAD53, \ #SEM_CONN_TSM_OK_FORM_REQ_CNT
0xAD54, \ #SEM_CONN_TSM_FAILED_EXEC_REQ_CNT
0xAD55, \ #SEM_CONN_TSM_CURL_SEND_CNT
0xAD56, \ #SEM_CONN_TSM_LAST_REQ
0xAD57, \ #SEM_CONN_TSM_LAST_FAILED_FORM_REQ
0xAD58, \ #SEM_CONN_TSM_LAST_OK_FORM_REQ
0xAD59, \ #SEM_CONN_TSM_FAILED_EXEC_REQ
0xAD5A, \ #SEM_CONN_TSM_LAST_CURL_TIME
0xAD5B, \ #SEM_CONN_TSM_LAST_SERV_TIME
0xAD5C, \ #SEM_CONN_TSM_MSG_QUEUE_PROP
0xAD5D, \ #SEM_CONN_TSM_SRV_CHECK
0xAD5E, \ #SEM_CONN_TSM_CONN_REC
0xAD5F, \ #SEM_CONN_TSM_SEND_RET
0xAD60, \ #SEM_CONN_TSM_SEND_INTERVAL
0xAD61 #SEM_CONN_TSM_ADMIN_URL

[cc:eek:nstar]
type=CONNECTIVITY
code=1148
mons=0xAD62, \ #SEM_CONN_OBM_ONSTAR_DEVICE_PRESENCE
0xAD63, \ #SEM_CONN_OBM_ONSTAR_WIFI_SETTINGS_PROPERTIES
0xAD64 #SEM_CONN_OBM_ONSTAR_PRIVACY_SETTINGS_PROPERTIES
spies=0xAD62, \ #SEM_CONN_OBM_ONSTAR_DEVICE_PRESENCE
0xAD63, \ #SEM_CONN_OBM_ONSTAR_WIFI_SETTINGS_PROPERTIES
0xAD64 #SEM_CONN_OBM_ONSTAR_PRIVACY_SETTINGS_PROPERTIES

[cc:AUD]
type=AUDIO
code=1149
mons=0xB000, \ #SEM_AUD_ECNR_VERSION
0xB001 #SEM_AUD_DIRANA_VERSION
spies=0xB000, \ #SEM_AUD_ECNR_VERSION
0xB001 #SEM_AUD_DIRANA_VERSION

[cc:VEH]
type=VEHICLE
code=1151
mons=0xB100 #SEM_VEH_DENSO_VERSION
spies=0xB100 #SEM_VEH_DENSO_VERSION

[cc:Version]
type=SSW
code=1152
mons=0x18, \ #SEM_VUC_SW_VERSION
0x19, \ #SEM_VUC_CAN_VERSION
0x1A, \ #SEM_VUC_HARDWARE_VERSION
0x206, \ #SEM_OWN_OVERALL_SW_VERSION
0x207, \ #SEM_OWN_SOC_SW_VERSION
0x208, \ #SEM_OWN_SOC_PDK_VERSION
0x209, \ #SEM_OWN_VUC_SW_VERSION
0x20A, \ #SEM_OWN_DAB_SW_VERSION
0x20B, \ #SEM_OWN_HARDWARE_VARIANT
0x20C, \ #SEM_OWN_DISPLAY_VARIANT
0x20D, \ #SEM_OWN_BT_MAC_ADDRESS
0x20E, \ #SEM_OWN_WIFI_MAC_ADDRESS
0x20F, \ #SEM_OWN_CUSTOMER_VERSION
0x210, \ #SEM_OWN_CUSTOMER_RELEASE_DATE
0xAB0A, \ #SEM_RAD_DAB_VERSION
0xAC01, \ #SEM_SPC_TTS_VERSION
0xAC02, \ #SEM_SPC_VR_VERSION
0xAE05, \ #SEM_NAV_RELEASE_VERSION
0xAE06, \ #SEM_NAV_MAP_VERSION
0xAE11, \ #SEM_NAV_GPS_FIRMWARE_VERSION
0xAF02, \ #SEM_HMI_HAND_WRITING_VERSION
0xAF03, \ #SEM_HMI_PIN_YIN_VERSION
0xB000, \ #SEM_AUD_ECNR_VERSION
0xB001, \ #SEM_AUD_DIRANA_VERSION
0xB100 #SEM_VEH_DENSO_VERSION
spies=0x18, \ #SEM_VUC_SW_VERSION
0x19, \ #SEM_VUC_CAN_VERSION
0x1A, \ #SEM_VUC_HARDWARE_VERSION
0x206, \ #SEM_OWN_OVERALL_SW_VERSION
0x207, \ #SEM_OWN_SOC_SW_VERSION
0x208, \ #SEM_OWN_SOC_PDK_VERSION
0x209, \ #SEM_OWN_VUC_SW_VERSION
0x20A, \ #SEM_OWN_DAB_SW_VERSION
0x20B, \ #SEM_OWN_HARDWARE_VARIANT
0x20C, \ #SEM_OWN_DISPLAY_VARIANT
0x20D, \ #SEM_OWN_BT_MAC_ADDRESS
0x20E, \ #SEM_OWN_WIFI_MAC_ADDRESS
0x20F, \ #SEM_OWN_CUSTOMER_VERSION
0x210, \ #SEM_OWN_CUSTOMER_RELEASE_DATE
0xAB0A, \ #SEM_RAD_DAB_VERSION
0xAC01, \ #SEM_SPC_TTS_VERSION
0xAC02, \ #SEM_SPC_VR_VERSION
0xAE05, \ #SEM_NAV_RELEASE_VERSION
0xAE06, \ #SEM_NAV_MAP_VERSION
0xAE11, \ #SEM_NAV_GPS_FIRMWARE_VERSION
0xAF02, \ #SEM_HMI_HAND_WRITING_VERSION
0xAF03, \ #SEM_HMI_PIN_YIN_VERSION
0xB000, \ #SEM_AUD_ECNR_VERSION
0xB001, \ #SEM_AUD_DIRANA_VERSION
0xB100 #SEM_VEH_DENSO_VERSION


To open the cheatcode window you have to press at least 6 seconds the multimedia button from nac.

Enter first the cheatcode (for example 1130) and then the code 1122.
Repeat it with every entered code.

Example:
First -> 1130
Second -> 1122

First -> 1131
Second -> 1122

First -> 1132
Second -> 1122

And so on.


@rui.saraiva
It would be helpful if you upload the complete update package.
 
Last edited:

rui.saraiva

Member
Apr 4, 2020
10
5
3
Lisbon
As you can see in the root filesystem, the kernel (3.10.17) does have the usbnet module compiled (lib/modules).
I did try a USB 2 Ethernet device with compatible USB hardware vendor/device ids and the module is loaded. It might be easier than using a jtag or serial console.

I will try to upload the full .tar
 

horuscurcino

Member
Oct 30, 2010
31
19
28
Sao Paulo/SP
As you can see in the root filesystem, the kernel (3.10.17) does have the usbnet module compiled (lib/modules).
I did try a USB 2 Ethernet device with compatible USB hardware vendor/device ids and the module is loaded. It might be easier than using a jtag or serial console.

I will try to upload the full .tar
Since you have compatible USB ethernet, check those addresses if there are open ports:

Code:
# Wired or wireless interfaces

# auto eth0
#iface eth0 inet dhcp
#iface eth1 inet dhcp
auto eth0
iface eth0 inet static                                                       
	address	192.168.1.112
	netmask	255.255.255.0	
	network	192.168.0.0	
	broadcast 192.168.0.255
	gateway	192.168.0.1

# Ethernet/RNDIS gadget (g_ether)
# ... or on host side, usbnet and random hwaddr
iface usb0 inet static
	address 192.168.0.202
	netmask 255.255.255.0
	network 192.168.0.0
	gateway 192.168.0.200


# Zaurus 2.4 Lineo net_fd; obsolete
iface usbd0 inet static
	address 192.168.129.201
	netmask 255.255.255.0
	network 192.168.129.0
	gateway 192.168.129.200

# iPAQ 2.4 mach-sa1100/usb-eth
# (192.168.0.202 is the iPAQ's IP, 192.168.0.200 is the host's IP)
iface usbf inet static
        address 192.168.0.202
        netmask 255.255.255.0
        network 192.168.0.0
        gateway 192.168.0.200

# Bluetooth networking
iface bnep0 inet dhcp

To extract firmware i used binwalk for linux. No username and password is needed.
 
  • Like
Reactions: Le()nid

Crunchy_Nuts

Member
Apr 9, 2018
9
5
0
As you can see in the root filesystem, the kernel (3.10.17) does have the usbnet module compiled (lib/modules).
I did try a USB 2 Ethernet device with compatible USB hardware vendor/device ids and the module is loaded. It might be easier than using a jtag or serial console.

I will try to upload the full .tar
I also tried it with an plug&play ethernet to usb adapter but can't get a connection.
The connection itself is ok, but I don't get an answer from nac.
Tried it with all usb ports including the green one.

That's why I tried uart but as long as you don't know the username and password, you have no chance.

The mime decryption is also really annoying. :rolleyes:
@horuscurcino
All ports are closed.
Tried it with bluetooth and wifi.
 
Last edited:

horuscurcino

Member
Oct 30, 2010
31
19
28
Sao Paulo/SP
Seems only compatible USB to Ethernet adapters will have the IP configuration assigned.
Found this drivers on the kernel/modules folder:

Code:
asix.ko
ax88179_178a.ko
cdc_ether.ko
cdc_ncm.ko
hso.ko
ipheth.ko
net1080.ko
rndis_host.ko
usbnet.ko
We need to check which device uses each of this drivers. For example, ive checked the asix.ko driver refers to "Monoprice USB 2.0 Ultrabook Ethernet Adapter ( Low Power )". A low-cost USB to Ethernet device.

As these drivers are whitelisted i think it should allow the SSH or TELNET access.
The wireless folder has only the internal WLAN driver for the NAC which results on closed ports as you said.
 
  • Like
Reactions: Le()nid

rui.saraiva

Member
Apr 4, 2020
10
5
3
Lisbon
Yes, all tcp/udp ports are closed - I also tried all 3 USB ports and wifi.
The USB 2 Ethernet might be useful after configuring network interface and running telnetd or sshd - I did install that old firmware without errors, so it doesn't need any certificates/encryption. And that might be a way to run any commands on NAC - a special SWL\*\Firmware\FirmwareList.ini file. BTW, that 18-digit number, the MediaVersion or UpdateID, has always a fixed format, it can identify if it's a firmware update, map update (and specific region map), and the last 10-digits are the compilation time in UNIX epoch format (number of seconds since January 1st 1970).

This is for RCC, but also interesting (pages 5-8) - https fccid (dot) io (slash) YBN-PSARCCA100 (slash) User-Manual (slash) Users-Manual-iPerf-and-RTA-tests-3119672.pdf

---------- Post added at 11:15 PM ---------- Previous post was at 11:08 PM ----------

Seems only compatible USB to Ethernet adapters will have the IP configuration assigned.
Found this drivers on the kernel/modules folder:

Code:
asix.ko
ax88179_178a.ko
cdc_ether.ko
cdc_ncm.ko
hso.ko
ipheth.ko
net1080.ko
rndis_host.ko
usbnet.ko
We need to check which device uses each of this drivers. For example, ive checked the asix.ko driver refers to "Monoprice USB 2.0 Ultrabook Ethernet Adapter ( Low Power )". A low-cost USB to Ethernet device.

As these drivers are whitelisted i think it should allow the SSH or TELNET access.
The wireless folder has only the internal WLAN driver for the NAC which results on closed ports as you said.
You can use modinfo on those modules and see what USB vendor/device ids it supports. I've a "Ugreen USB 3.0 to 10/100/1000 Ethernet Network Adapter" (USB ID 0B95:1790) with a Asix AX88179 chip.

sshd and telnetd aren't running. It's easy to extract that information from any spylog. It's also easy to grep the .dlt files (Diagnostic Log & Trace) to extract the dmesg info.

---------- Post added at 11:33 PM ---------- Previous post was at 11:15 PM ----------

Finished uploading the firmware. After unzip it, you'll get the original .tar file that was available in 2017: https gofile (dot) io (slash) ?c=2Jaw5E
Never used the gofile service before, don't know how long that file stays there...
 
Last edited:
  • Like
Reactions: horuscurcino

Crunchy_Nuts

Member
Apr 9, 2018
9
5
0
You can use modinfo on those modules and see what USB vendor/device ids it supports. I've a "Ugreen USB 3.0 to 10/100/1000 Ethernet Network Adapter" (USB ID 0B95:1790) with a Asix AX88179 chip.

sshd and telnetd aren't running.

Damn it, mine is also from Ugreen.:crying:

I also tested it with an USB Ethernet adapter from Dlink and it's not working.

Do you think you have more permissions with ssh via ethernet instead of uart?:confused:

Did you tried to get somehow into the recovery mode?
Maybe with an external keyboard.:confused:

My order from aliexpress (Cables and touchscreen) is still not here. :crying:


Finished uploading the firmware. After unzip it, you'll get the original .tar file that was available in 2017: https gofile (dot) io (slash) ?c=2Jaw5E
Never used the gofile service before, don't know how long that file stays there...
Thanks for uploading mate. :good:
 

rui.saraiva

Member
Apr 4, 2020
10
5
3
Lisbon
...
Do you think you have more permissions with ssh via ethernet instead of uart?:confused:

Did you tried to get somehow into the recovery mode?
Maybe with an external keyboard.:confused:
...
No, but I haven't any other system to test, only the one installed in my car. I don't want to mess around with it (disassemble the hardware).

I didn't try any recovery mode (how?, I also didn't extract the boot loader, the 101010{7,8}_EU_BL.FRG files) but now that you wrote about an external keyboard, I'll check if the kernel has SysRq support. I'll also check the /usr/bin/sem_dm_server binary, the one that handles the \id files.

Also if anyone want to extract the dmesg info from the .dlt files of the spylogs:
Code:
strings *.dlt | grep "^\[.\{4\}[0-9]\.[0-9]\{6\}\] "