hacking nac peugeot

[[email protected]]

7503900
Password

 

[Il gladiatore]

7503900
parola d’ordine

Is this password also valid for the 2017 NAC? it is possible to install android apps on the NAC, since it has android auto it must have a small android system where you can install applications.

 

[kolomparrudi]

I got rootfs\usr\bin\sem_dm_server is file and use ida to open. Can't find the id you said...


Also I try to modify the rootfs.fsn.Then may update use the modify rootfs.
But can't encrypt ....
I just decrypt rootfs.fsn02.And use the crt file in SWL to encrypt the rootfs.fsn02.


But the file out is not same with the original file. Is that the public key or encrypt command error.I think just the key error.
How to find the original public key.

I tried to use the cerficate shipped with the firmware to encrpyt, but the firware keys can't decode it, so not this certificate used for the encrpytion. I managed to create self signed certificate from the firware key and can encrypt the firmware back, but I'm not sure if device has any certificate check.
Here is how I managed to do it:
openssl req -new -key Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.csr
openssl x509 -req -in Firmware_Keys/WAVE2/21.08.84-12-r0.csr -signkey Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.crt

openssl smime -encrypt -aes256 -in SWL/001315031601451350/Firmware/AUTO/1010103/NAC_B2/OVIP/rootfs.fsn -binary -outform SMIME -out rootfs.fsn.enc Firmware_Keys/WAVE2/21.08.84-12-r0.crt

Used this github repo for the firware keys: https://github.com/ludwig-v/psa-nac-firmware-reverse-engineering

 

[jamesD92]

with regards to these Firmware_Keys on the github site above, does anyone know how these private keys are being generated?
@kolomparrudi did you get any further proving the self signing method works on a NAC unit?

 

[jamesD92]

GitHub - sabsteef/psa-uds-nac: A short sort of karma and security, with code inside.

A short sort of karma and security, with code inside. - GitHub - sabsteef/psa-uds-nac: A short sort of karma and security, with code inside.

github.com

This might be useful to some people

 

[just4u32]

I have found keys to decrypt firmware in Github "psa-nac-firmware-reverse-engineering"

I have uploaded firmware, decrypted-extracted firmware, and script_keys in google drive to make it easier to download anyone who is interested in this.
"drive.google.com/drive/folders/1_twUGEcjGGxYGINgGsaCYC23DraC8pNx?usp=sharing"
PS: I am no expert in all these, just here to find a way to enable 5GHZ (wireless), wireless android auto, and tomtom traffic in Australia.

Did you manage to unlock nav or 5ghz? I'm trying too but couldnt find any info.

Thanks

 

[Arkady.es]

---------- Post added at 12:34 PM ---------- Previous post was at 12:02 PM ----------

Found it!

The id is ->

9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f

You find it under rootfs\usr\bin\sem_dm_server

So the complete content of the usb file is

#USB Demo file
[general]
id=9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f

# Activate engineering mode
# engineering_mode=0 (Absent) engineering_mode=1 (Present)
engineering_mode=1

# Create one spy
# create_spy=0 (don't create spy) create_spy=1 (create spy)
create_spy=1

# Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND
sync_spies_with_usb=1

Create a file and rename it to ID (without any file extension!) and copy the code above into the file.
Copy the file in the root directory of the usb stick and plug it in to the nac.

After you insert it in the nac, it will copy the spylogs to usb.

And maybe you can do other things with the engineering mode.

BRILLIANT!!!!

I wonder if I can use your method to create a file with commands to deactivate completely the bluetooth connection. I guess there would be something like bluetooth_module=0.

Do you know how to find it??

In addition, I don't understand how to get the ID. How can I access to rootfs\usr\bin\sem_dm_server?

 

[Arkady.es]

I got rootfs\usr\bin\sem_dm_server is file and use ida to open. Can't find the id you said...


Also I try to modify the rootfs.fsn.Then may update use the modify rootfs.
But can't encrypt ....
I just decrypt rootfs.fsn02.And use the crt file in SWL to encrypt the rootfs.fsn02.


But the file out is not same with the original file. Is that the public key or encrypt command error.I think just the key error.
How to find the original public key.

Hi @carson512. You are many steps forward me to reach the id as @Crunchy_Nuts said.

Would you mind sending me some guide or some tips to access the filesystem? It has been said here it was posted in the forum but I have not find it.

If anybody has the post I would really appreciate it.

 

[futee]

Hi Friends!

Is there any solution to open a hidden colour scheme in Peugeot 5008 icockpit?

 

[wxhank]

up up, how to install wave4 firmware on wave2

 

[ricjuh]

I want to know if it's possible to disable to black bars on widescreen display.. On the PSA website they say this space is dedicated to the infotainment system. But it's really anoying to have a 'premium' display with 2 black bars and no widescreen support.

 

[futee]

I want to know if it's possible to disable to black bars on widescreen display.. On the PSA website they say this space is dedicated to the infotainment system. But it's really anoying to have a 'premium' display with 2 black bars and no widescreen support.

View attachment 5442239

No!
As you can see on your picture the side has differnt resolution and can not show the high resolution objects. It is a shame that PSA can not install fully high resolution display. the price difference should be coins.

 

[ricjuh]

No!
As you can see on your picture the side has differnt resolution and can not show the high resolution objects. It is a shame that PSA can not install fully high resolution display. the price difference should be coins.

The screen has 1 resolution of 1920x720.. It's just divided by PSA to show different info.. During a software update the whole screen is used so it should be possible somehow to trick the system in showing fullscreen stuff.

 

[futee]

The screen has 1 resolution of 1920x720.. It's just divided by PSA to show different info.. During a software update the whole screen is used so it should be possible somehow to trick the system in showing fullscreen stuff.

I'm waiting that update....

 

[MrPoofy]

Do we have any news for the Android Auto Full Screen?

 

[aleabry]

Hi, I have a peugeot 208 allure latest model 2022 without navigator, I changed the rcc module with a nac wave 4 with two video outputs one connected to the icockpit 3d. How should I do to enable (with arduino plus can bus) the navigator, thanks

 

[futee]

The screen has 1 resolution of 1920x720.. It's just divided by PSA to show different info.. During a software update the whole screen is used so it should be possible somehow to trick the system in showing fullscreen stuff.

Hello! I had ask a professional about the full screen, here is the answer:

"Not possible without being root and even being root it is almost impossible because each part of the screen is a separated process (and it is a proprietary binary to edit)"

 

[ricjuh]

Hello! I had ask a professional about the full screen, here is the answer:

"Not possible without being root and even being root it is almost impossible because each part of the screen is a separated process (and it is a proprietary binary to edit)"

I hope that in the future some parts of the software are becoming opensource, so we can choose what we want to display on the screen instead of being forced to use this layout

 

[Nabil2106]

hi everyone,
I changed my RCC to a NaC wave 4 HD on my Peugeot 2008 II. All worked properly, but I had a very (very) bad idea to update the firmware.
Now my nac is blocked on the Blue screen “downloading on demand” every time I try to put the firmware using the VIN donner to have the license, I have the message “firmware update error” In the middle of the update.
I tried everything I found and the result is always the same. Whiteout license the result is the same also.

If you have any idea I will be grateful

 

[NeeK9]

7503900
Password

How you get in this menu? Can you share?
In a unit NAC without Navigation can be enabled Navi and installed maps?

Thanks in advance