-
Introducing XDA Computing: Discussion zones for Hardware, Software, and more! Check it out!
hacking nac peugeot
- Thread starter crazychimp80
- Start date
Is this password also valid for the 2017 NAC? it is possible to install android apps on the NAC, since it has android auto it must have a small android system where you can install applications.
I tried to use the cerficate shipped with the firmware to encrpyt, but the firware keys can't decode it, so not this certificate used for the encrpytion. I managed to create self signed certificate from the firware key and can encrypt the firmware back, but I'm not sure if device has any certificate check.
Here is how I managed to do it:
openssl req -new -key Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.csr
openssl x509 -req -in Firmware_Keys/WAVE2/21.08.84-12-r0.csr -signkey Firmware_Keys/WAVE2/21.08.84-12-r0.key -out Firmware_Keys/WAVE2/21.08.84-12-r0.crt
openssl smime -encrypt -aes256 -in SWL/001315031601451350/Firmware/AUTO/1010103/NAC_B2/OVIP/rootfs.fsn -binary -outform SMIME -out rootfs.fsn.enc Firmware_Keys/WAVE2/21.08.84-12-r0.crt
Used this github repo for the firware keys: https://github.com/ludwig-v/psa-nac-firmware-reverse-engineering
with regards to these Firmware_Keys on the github site above, does anyone know how these private keys are being generated?
@kolomparrudi did you get any further proving the self signing method works on a NAC unit?
@kolomparrudi did you get any further proving the self signing method works on a NAC unit?
GitHub - sabsteef/psa-uds-nac: A short sort of karma and security, with code inside.
A short sort of karma and security, with code inside. - GitHub - sabsteef/psa-uds-nac: A short sort of karma and security, with code inside.
github.com
Did you manage to unlock nav or 5ghz? I'm trying too but couldnt find any info.
Thanks
---------- Post added at 12:34 PM ---------- Previous post was at 12:02 PM ----------
Found it!
The id is ->Code:9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f
You find it under rootfs\usr\bin\sem_dm_server
So the complete content of the usb file is
Code:#USB Demo file [general] id=9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f # Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1 # Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
Create a file and rename it to ID (without any file extension!) and copy the code above into the file.
Copy the file in the root directory of the usb stick and plug it in to the nac.
After you insert it in the nac, it will copy the spylogs to usb.
And maybe you can do other things with the engineering mode.
BRILLIANT!!!!
I wonder if I can use your method to create a file with commands to deactivate completely the bluetooth connection. I guess there would be something like bluetooth_module=0.
Do you know how to find it??
In addition, I don't understand how to get the ID. How can I access to rootfs\usr\bin\sem_dm_server?
Last edited:
Hi @carson512. You are many steps forward me to reach the id as @Crunchy_Nuts said.
Would you mind sending me some guide or some tips to access the filesystem? It has been said here it was posted in the forum but I have not find it.
If anybody has the post I would really appreciate it.
I want to know if it's possible to disable to black bars on widescreen display.. On the PSA website they say this space is dedicated to the infotainment system. But it's really anoying to have a 'premium' display with 2 black bars and no widescreen support.
No!
As you can see on your picture the side has differnt resolution and can not show the high resolution objects. It is a shame that PSA can not install fully high resolution display. the price difference should be coins.
The screen has 1 resolution of 1920x720.. It's just divided by PSA to show different info.. During a software update the whole screen is used so it should be possible somehow to trick the system in showing fullscreen stuff.
Top Liked Posts
-
There are no posts matching your filters.
-
3
Sad to hear...:crying:
But there must be some possibility for the recovery mode, or not?
I mean, as a developer you always have to keep a back door clear in case the system breaks.
What if you try to use the usb stick?
As far as we know there's an option called engineer mode.
Code:# Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1
Maybe it has another effect.
My ideas would be that maybe you can use it to call a function / module to unlock.
Like this:
Code:# Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
Or maybe just leave the USB Stick (with engineering_mode=1) plugged in and see if something changes at the ports.
And maybe the engineer mode is bound to an "id" to work.
To copy spylogs you also need engineer mode and an id (id = ???).
It won't work without the id.
Search for something like this:
Code:#USB Demo file [general] id=
This is the complete procedure to copy spylogs from nac directly to usb without doing anything.
Code:#USB Demo file [general] id=????????????? # Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1 # Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
---------- Post added at 12:34 PM ---------- Previous post was at 12:02 PM ----------
Found it!
The id is ->Code:9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f
You find it under rootfs\usr\bin\sem_dm_server
So the complete content of the usb file is
Code:#USB Demo file [general] id=9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f # Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1 # Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
Create a file and rename it to ID (without any file extension!) and copy the code above into the file.
Copy the file in the root directory of the usb stick and plug it in to the nac.
After you insert it in the nac, it will copy the spylogs to usb.
And maybe you can do other things with the engineering mode.2It is also possible to copy the spylogs directly to usb with these commands
engineering_mode=1
create_spy=1
sync_spies_with_usb=1
You just have to create a file called "id" without file ending and put it on your usb stick in the root directory.
You may also need a "id=xxxx" commmand in the "id" file. (xxxx = a long id number needed)
Maybe there are more commands for usb.
---------- Post added at 12:39 PM ---------- Previous post was at 12:23 PM ----------
And here are the Cheatcodes & informations (maybe not all codes, who knows)
To open the cheatcode window you have to press at least 6 seconds the multimedia button from nac.
Enter first the cheatcode (for example 1130) and then the code 1122.
Repeat it with every entered code.
Example:
First -> 1130
Second -> 1122
First -> 1131
Second -> 1122
First -> 1132
Second -> 1122
And so on.
@rui.saraiva
It would be helpful if you upload the complete update package.2An old NAC Wave 2 firmware version 21.05.65.32 (early 2017), was wrongly released without any encryption. It was pulled some hours later, but it was a bit too late... I've the full update .tar file, but here's some of the interesting files, including the root filesystem, after converting/extracting - https drive (dot) google (dot) com (slash) open?id=1ocCo5WJheeBkChpydxkE1Q28UYh0Xjq91
First of all, does anyone know that LINUX can run Android within? Would it be possible to enter the NAC system to install Android apps?
