hacking nac peugeot
- Thread starter crazychimp80
- Start date
Pin location
The pins at on the middle connector.
It should be the yellow part wich is in the middle of the connector.
Pin 23 and 24
And
Pin 29 and 30
Regards
The pins at on the middle connector.
It should be the yellow part wich is in the middle of the connector.
Pin 23 and 24
And
Pin 29 and 30
Regards
Thank you. They are the same on the BOSCH RCC unit but they dont give a proper output. Perhaps it is a fault of my TTL device. I was testing in the continental NAC unit and found two interesting things:
first, the boot text shows the path of the development folders
Code:
sh[3691]: OIPBI: Used SDK (Toolchain): /PROJ/oip/SDK/MG_20170106_M11_7.0.165p/MV_Tools
sh[3691]: OIPBI: Used Mirror: /PROJ/oip/PDK/20170613_PDK_11.00.120.03/Mirror/solutions/com.continental/MV_PINTAnd also says:
Code:
sh[3691]: OIPBI: Machine: Linux radfmxyu 3.13.0-106-generic #153~precise1-Ubuntu SMP Tue Dec 6 16:12:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build Info
sh[3691]: OIPBI:
sh[3691]: OIPBI: Builder: uidg6656
sh[3691]: OIPBI: Built: jeudi 15 juin 2017, 12:28:06 (UTC+0200)
sh[3691]: OIPBI:
sh[3691]: OIPBI: Build BL #Version: NAC_SOC_SYS_65.05.24.32_RCC #1I think the username we need to explore is "uidg6656" and the path to find the password (or a hint of it) can be found on the firmware files. Linux usually stores passwords onto a file called "passwd" in "/etc" folder. However it needs to be decrypted.
For your information, these are the fundamentals of the software we are trying to access: http://events17.linuxfoundation.org/sites/events/files/slides/PSA_GENIVI_aboard_-_ALS.pdf
And the opensource software codes used on those units:
https://www.groupe-psa.com/en/oss/
Last edited:
can you point the rs in rcc connector
interesting here about RCC unit is possible to connect via sub2lan https://fccid.io/YBN-PSARCCA100/Use...hnical-Passport-3119654/ViewExhibitReport.cfm
Last edited:
For RCC is the same as MitchtheMitch said. Look in the document you posted there are "debug" lines on these pins. By the way, the LAN connection was not possible here using USB to Ethernet adapters (tried 3 different models/vendors). I think bosch submit to the test center an unlocked unit to make the certification tests possible.
Found this on "passwd" file from NAC firmware.
It shows all the registered users for this unit to use the linux environment
The structure says:
USER:X or * if a password is assigned:user directory
The only one not assigned as you can see is root user. But anyway it gaves me errors when trying to log in without password.
Unfortunately i cannot find the "shadows" file where the passwords are supposed to be stored in.
Found another file saying the password for some instance is "files" without quotes. Can you test it for those usernames?
Found this on "passwd" file from NAC firmware.
It shows all the registered users for this unit to use the linux environment
The structure says:
USER:X or * if a password is assigned:user directory
Code:
root::0:0:root:/home/root:/bin/sh
daemon:*:1:1:daemon:/usr/sbin:/bin/sh
bin:*:2:2:bin:/bin:/bin/sh
sys:*:3:3:sys:/dev:/bin/sh
sync:*:4:65534:sync:/bin:/bin/sync
games:*:5:60:games:/usr/games:/bin/sh
man:*:6:12:man:/var/cache/man:/bin/sh
lp:*:7:7:lp:/var/spool/lpd:/bin/sh
mail:*:8:8:mail:/var/mail:/bin/sh
news:*:9:9:news:/var/spool/news:/bin/sh
uucp:*:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:*:13:13:proxy:/bin:/bin/sh
www-data:*:33:33:www-data:/var/www:/bin/sh
backup:*:34:34:backup:/var/backups:/bin/sh
list:*:38:38:Mailing List Manager:/var/list:/bin/sh
irc:*:39:39:ircd:/var/run/ircd:/bin/sh
gnats:*:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:*:65534:65534:nobody:/nonexistent:/bin/sh
xuser:x:100:101:Linux User,,,:/tmp:/bin/sh
messagebus:x:101:103:Linux User,,,:/var/lib/dbus:/bin/false
pulse:x:102:1000:Linux User,,,:/tmp/home/pulse/:/bin/false
polkituser:x:104:1002:polkituser:/var/run/polkit:/bin/false
Org:x:0:0:org.genivi.NodeStartupController1:/:/bin/false
SerGet:x:0:0:serial-getty@:/:/bin/false
sysdquot:x:0:0:systemd-quotacheck:/:/bin/false
dbuspub:x:10678:10678:dbus-public-bus:/:/bin/false
Dbu:x:0:0:dbus:/:/bin/false
dbssess:x:0:0:mm-dbus-session:/:/bin/false
rngd:x:10100:10100:rngd:/:/bin/false
hkdiag:x:10041:10041:diag-svc-plf-coding-daemon:/:/bin/false
rescue:x:0:0:rescue:/:/bin/false
console:x:0:0:getty@:/:/bin/false
systime:x:10014:10014:restore-system-time:/:/bin/false
quotaon:x:0:0:quotaon:/:/bin/false
persist:x:0:0:pas-daemon:/:/bin/false
persVlow:x:10090:10090:vlow-container-svc-daemon:/:/bin/false
systemd:x:0:0:systemd-exit:/:/bin/false
lcnsm:x:10010:10010:node state manager:/:/bin/false
lcnsc:x:10012:10012:node state manager:/:/bin/false
lcnhm:x:10567:10567:node-health-monitor:/:/bin/false
audmgr:x:14573:14573:media-audiomanager:/tmp/:/bin/false
audpls:x:10020:10020:pulseaudio:/var/run/pulse:/bin/false
audalsa:x:10573:10573:alsa-state:/:/bin/false
audsnd:x:10311:10311:media-soundgen-ref:/tmp:/bin/false
media:x:10030:10030:oip-media-timeshift:/tmp:/bin/false
video:x:10222:10222:splash:/:/bin/false
contel:x:10040:10040:oip-pi-telephonyservice:/:/bin/false
concb:x:10039:10039:oip-pi-contactbook:/:/bin/false
conmsg:x:10038:10038:oip-pi-messaging:/:/bin/false
conml:x:10053:10053:oip-pi-mirrorlink:/:/bin/false
conbrw:x:10037:10037:oip-pi-wbf:/:/bin/false
concm:x:0:0:connman:/:/bin/false
conwf:x:0:0:wifi:/:/bin/false
conusb:x:10001:10001:usbmgr:/:/bin/false
conbt:x:10042:10042:bluetooth:/:/bin/false
conphnpl:x:0:0:oip-pi-phoneplugin:/:/bin/false
swlman:x:0:0:swl-manager:/:/bin/false
mchineid:x:0:0:machineid:/:/bin/false
Key:x:0:0:keyprovider:/:/bin/false
udisks:x:0:0:udisks-daemon:/:/bin/false
persftop:x:0:0:top:/:/bin/false
firewall:x:0:0:iptables:/:/bin/false
graphic:x:10501:10501:wayland:/:/bin/false
ltsyslog:x:0:0:syslog-ng:/:/bin/false
ltdlt:x:10006:10006:dlt:/:/bin/false
ltdltsys:x:10007:10007:dlt:/:/bin/false
ltdltprint:x:10008:10008:dlt:/:/bin/false
persubi:x:0:0:ubi-attach2:/:/bin/false
NhmRec:x:0:0:nhm-recovery:/:/bin/false
NrmRec:x:0:0:nrm-recovery:/:/bin/false
VloSvcRec:x:0:0:vlow-svc-recovery:/:/bin/false
inptouchcal:x:0:0:oip-ssw-touch-calibration:/:/bin/false
slwmdutl:x:0:0:SWLD user:/:/bin/false
swlopkg:x:0:0:SWLD user opkg:/:/bin/false
SysUpdUtmShu:x:0:0:user update:/:/bin/false
conhfc:x:10568:10568:Handsfree Service:/:/bin/false
usbmux:*:10570:10570::/:/bin/false
concedc:*:10571:10571::/:/bin/false
lcnrm:*:10572:10572::/:/bin/false
fws:*:10573:10573::/:/bin/false
radio:*:10575:10575::/:/bin/false
i2c:*:10578:10578::/:/bin/false
infdat:*:10580:10580::/:/bin/false
phm-fsuc:*:10582:10569:phm-fsuc:/:/bin/false
persNba:*:10587:10587:Pers - NBA daemon:/:/bin/false
persVlow:*:10589:10589:Pers - Vlow container daemon:/:/bin/false
persHwi:*:10590:10590:Pers - HWInfo container daemon:/:/bin/false
persErly:*:10591:10591:Pers - EarlyData container daemon:/:/bin/false
persScrd:*:10592:10592:Pers - SecuredData container daemon:/:/bin/false
persIio:*:10594:10594:Pers - ImageIO ():/:/bin/false
condhcp:*:10596:10596:Conectivity DHCP daemon:/tmp:/bin/false
conaap:*:10598:10598:oip-connsvc-androidauto:/:/bin/false
usrprfmgr:*:10599:10599:User Profile Manager:/tmp:/bin/falseThe only one not assigned as you can see is root user. But anyway it gaves me errors when trying to log in without password.
Unfortunately i cannot find the "shadows" file where the passwords are supposed to be stored in.
Found another file saying the password for some instance is "files" without quotes. Can you test it for those usernames?
Last edited:
Pretty good work!
So you set following:
Login: x
password: passwd
Is that correct?
Like you, I did try to connect it via USB and serial and telnet but without success.
Regards
An old NAC Wave 2 firmware version 21.05.65.32 (early 2017), was wrongly released without any encryption. It was pulled some hours later, but it was a bit too late... I've the full update .tar file, but here's some of the interesting files, including the root filesystem, after converting/extracting - https drive (dot) google (dot) com (slash) open?id=1ocCo5WJheeBkChpydxkE1Q28UYh0Xjq9
Thank you, Rui ! It will certainly help on our research.
Muito obrigado!
Early chinese versions have the same security flaw.
www(dot)chengzhidan(dot)com(slash)auto(slash)NAC22-new(dot)rar
yadi(dot)sk(slash)d(slash)2kUiXTSOqoGoUA
Last edited:
Thir link does not work.
Thanks to Rui for the other link, maybe it will help more.
horuscurino, could you explain which parameters you set as Login name and password to extract the firmware darta?
i think somebody asked you allready before.
thank you
It is also possible to copy the spylogs directly to usb with these commands
engineering_mode=1
create_spy=1
sync_spies_with_usb=1
You just have to create a file called "id" without file ending and put it on your usb stick in the root directory.
You may also need a "id=xxxx" commmand in the "id" file. (xxxx = a long id number needed)
Maybe there are more commands for usb.
---------- Post added at 12:39 PM ---------- Previous post was at 12:23 PM ----------
And here are the Cheatcodes & informations (maybe not all codes, who knows)
To open the cheatcode window you have to press at least 6 seconds the multimedia button from nac.
Enter first the cheatcode (for example 1130) and then the code 1122.
Repeat it with every entered code.
Example:
First -> 1130
Second -> 1122
First -> 1131
Second -> 1122
First -> 1132
Second -> 1122
And so on.
@rui.saraiva
It would be helpful if you upload the complete update package.
engineering_mode=1
create_spy=1
sync_spies_with_usb=1
You just have to create a file called "id" without file ending and put it on your usb stick in the root directory.
You may also need a "id=xxxx" commmand in the "id" file. (xxxx = a long id number needed)
Maybe there are more commands for usb.
---------- Post added at 12:39 PM ---------- Previous post was at 12:23 PM ----------
And here are the Cheatcodes & informations (maybe not all codes, who knows)
To open the cheatcode window you have to press at least 6 seconds the multimedia button from nac.
Enter first the cheatcode (for example 1130) and then the code 1122.
Repeat it with every entered code.
Example:
First -> 1130
Second -> 1122
First -> 1131
Second -> 1122
First -> 1132
Second -> 1122
And so on.
@rui.saraiva
It would be helpful if you upload the complete update package.
Last edited:
As you can see in the root filesystem, the kernel (3.10.17) does have the usbnet module compiled (lib/modules).
I did try a USB 2 Ethernet device with compatible USB hardware vendor/device ids and the module is loaded. It might be easier than using a jtag or serial console.
I will try to upload the full .tar
I did try a USB 2 Ethernet device with compatible USB hardware vendor/device ids and the module is loaded. It might be easier than using a jtag or serial console.
I will try to upload the full .tar
Since you have compatible USB ethernet, check those addresses if there are open ports:
Code:
# Wired or wireless interfaces
# auto eth0
#iface eth0 inet dhcp
#iface eth1 inet dhcp
auto eth0
iface eth0 inet static
address 192.168.1.112
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1
# Ethernet/RNDIS gadget (g_ether)
# ... or on host side, usbnet and random hwaddr
iface usb0 inet static
address 192.168.0.202
netmask 255.255.255.0
network 192.168.0.0
gateway 192.168.0.200
# Zaurus 2.4 Lineo net_fd; obsolete
iface usbd0 inet static
address 192.168.129.201
netmask 255.255.255.0
network 192.168.129.0
gateway 192.168.129.200
# iPAQ 2.4 mach-sa1100/usb-eth
# (192.168.0.202 is the iPAQ's IP, 192.168.0.200 is the host's IP)
iface usbf inet static
address 192.168.0.202
netmask 255.255.255.0
network 192.168.0.0
gateway 192.168.0.200
# Bluetooth networking
iface bnep0 inet dhcpTo extract firmware i used binwalk for linux. No username and password is needed.
I also tried it with an plug&play ethernet to usb adapter but can't get a connection.
The connection itself is ok, but I don't get an answer from nac.
Tried it with all usb ports including the green one.
That's why I tried uart but as long as you don't know the username and password, you have no chance.
The mime decryption is also really annoying.
@horuscurcino
All ports are closed.
Tried it with bluetooth and wifi.
Last edited:
Seems only compatible USB to Ethernet adapters will have the IP configuration assigned.
Found this drivers on the kernel/modules folder:
We need to check which device uses each of this drivers. For example, ive checked the asix.ko driver refers to "Monoprice USB 2.0 Ultrabook Ethernet Adapter ( Low Power )". A low-cost USB to Ethernet device.
As these drivers are whitelisted i think it should allow the SSH or TELNET access.
The wireless folder has only the internal WLAN driver for the NAC which results on closed ports as you said.
Found this drivers on the kernel/modules folder:
Code:
asix.ko
ax88179_178a.ko
cdc_ether.ko
cdc_ncm.ko
hso.ko
ipheth.ko
net1080.ko
rndis_host.ko
usbnet.koWe need to check which device uses each of this drivers. For example, ive checked the asix.ko driver refers to "Monoprice USB 2.0 Ultrabook Ethernet Adapter ( Low Power )". A low-cost USB to Ethernet device.
As these drivers are whitelisted i think it should allow the SSH or TELNET access.
The wireless folder has only the internal WLAN driver for the NAC which results on closed ports as you said.
Yes, all tcp/udp ports are closed - I also tried all 3 USB ports and wifi.
The USB 2 Ethernet might be useful after configuring network interface and running telnetd or sshd - I did install that old firmware without errors, so it doesn't need any certificates/encryption. And that might be a way to run any commands on NAC - a special SWL\*\Firmware\FirmwareList.ini file. BTW, that 18-digit number, the MediaVersion or UpdateID, has always a fixed format, it can identify if it's a firmware update, map update (and specific region map), and the last 10-digits are the compilation time in UNIX epoch format (number of seconds since January 1st 1970).
This is for RCC, but also interesting (pages 5-8) - https fccid (dot) io (slash) YBN-PSARCCA100 (slash) User-Manual (slash) Users-Manual-iPerf-and-RTA-tests-3119672.pdf
---------- Post added at 11:15 PM ---------- Previous post was at 11:08 PM ----------
You can use modinfo on those modules and see what USB vendor/device ids it supports. I've a "Ugreen USB 3.0 to 10/100/1000 Ethernet Network Adapter" (USB ID 0B95:1790) with a Asix AX88179 chip.
sshd and telnetd aren't running. It's easy to extract that information from any spylog. It's also easy to grep the .dlt files (Diagnostic Log & Trace) to extract the dmesg info.
---------- Post added at 11:33 PM ---------- Previous post was at 11:15 PM ----------
Finished uploading the firmware. After unzip it, you'll get the original .tar file that was available in 2017: https gofile (dot) io (slash) ?c=2Jaw5E
Never used the gofile service before, don't know how long that file stays there...
The USB 2 Ethernet might be useful after configuring network interface and running telnetd or sshd - I did install that old firmware without errors, so it doesn't need any certificates/encryption. And that might be a way to run any commands on NAC - a special SWL\*\Firmware\FirmwareList.ini file. BTW, that 18-digit number, the MediaVersion or UpdateID, has always a fixed format, it can identify if it's a firmware update, map update (and specific region map), and the last 10-digits are the compilation time in UNIX epoch format (number of seconds since January 1st 1970).
This is for RCC, but also interesting (pages 5-8) - https fccid (dot) io (slash) YBN-PSARCCA100 (slash) User-Manual (slash) Users-Manual-iPerf-and-RTA-tests-3119672.pdf
---------- Post added at 11:15 PM ---------- Previous post was at 11:08 PM ----------
You can use modinfo on those modules and see what USB vendor/device ids it supports. I've a "Ugreen USB 3.0 to 10/100/1000 Ethernet Network Adapter" (USB ID 0B95:1790) with a Asix AX88179 chip.
sshd and telnetd aren't running. It's easy to extract that information from any spylog. It's also easy to grep the .dlt files (Diagnostic Log & Trace) to extract the dmesg info.
---------- Post added at 11:33 PM ---------- Previous post was at 11:15 PM ----------
Finished uploading the firmware. After unzip it, you'll get the original .tar file that was available in 2017: https gofile (dot) io (slash) ?c=2Jaw5E
Never used the gofile service before, don't know how long that file stays there...
Last edited:
Damn it, mine is also from Ugreen.:crying:
I also tested it with an USB Ethernet adapter from Dlink and it's not working.
Do you think you have more permissions with ssh via ethernet instead of uart?
Did you tried to get somehow into the recovery mode?
Maybe with an external keyboard.
My order from aliexpress (Cables and touchscreen) is still not here. :crying:
Thanks for uploading mate. :good:
...
Do you think you have more permissions with ssh via ethernet instead of uart?
Did you tried to get somehow into the recovery mode?
Maybe with an external keyboard.
...
No, but I haven't any other system to test, only the one installed in my car. I don't want to mess around with it (disassemble the hardware).
I didn't try any recovery mode (how?, I also didn't extract the boot loader, the 101010{7,8}_EU_BL.FRG files) but now that you wrote about an external keyboard, I'll check if the kernel has SysRq support. I'll also check the /usr/bin/sem_dm_server binary, the one that handles the \id files.
Also if anyone want to extract the dmesg info from the .dlt files of the spylogs:
Code:
strings *.dlt | grep "^\[.\{4\}[0-9]\.[0-9]\{6\}\] "Hello if you long press voice button , You will hear “voice logging activated “does anyone knows what is this
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
3
Sad to hear...:crying:
But there must be some possibility for the recovery mode, or not?
I mean, as a developer you always have to keep a back door clear in case the system breaks.
What if you try to use the usb stick?
As far as we know there's an option called engineer mode.
Code:# Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1
Maybe it has another effect.
My ideas would be that maybe you can use it to call a function / module to unlock.
Like this:
Code:# Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
Or maybe just leave the USB Stick (with engineering_mode=1) plugged in and see if something changes at the ports.
And maybe the engineer mode is bound to an "id" to work.
To copy spylogs you also need engineer mode and an id (id = ???).
It won't work without the id.
Search for something like this:
Code:#USB Demo file [general] id=
This is the complete procedure to copy spylogs from nac directly to usb without doing anything.
Code:#USB Demo file [general] id=????????????? # Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1 # Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
---------- Post added at 12:34 PM ---------- Previous post was at 12:02 PM ----------
Found it!
The id is ->Code:9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f
You find it under rootfs\usr\bin\sem_dm_server
So the complete content of the usb file is
Code:#USB Demo file [general] id=9cfd0bf57a94a3beb6c990e9c9c78247a8bc78fd3310aa6f58a247f8dabe3b7f # Activate engineering mode # engineering_mode=0 (Absent) engineering_mode=1 (Present) engineering_mode=1 # Create one spy # create_spy=0 (don't create spy) create_spy=1 (create spy) create_spy=1 # Option to automatically sync spies with USB. Currently it exports spies to USB and delete the existing ones on NAND sync_spies_with_usb=1
Create a file and rename it to ID (without any file extension!) and copy the code above into the file.
Copy the file in the root directory of the usb stick and plug it in to the nac.
After you insert it in the nac, it will copy the spylogs to usb.
And maybe you can do other things with the engineering mode.2It is also possible to copy the spylogs directly to usb with these commands
engineering_mode=1
create_spy=1
sync_spies_with_usb=1
You just have to create a file called "id" without file ending and put it on your usb stick in the root directory.
You may also need a "id=xxxx" commmand in the "id" file. (xxxx = a long id number needed)
Maybe there are more commands for usb.
---------- Post added at 12:39 PM ---------- Previous post was at 12:23 PM ----------
And here are the Cheatcodes & informations (maybe not all codes, who knows)
To open the cheatcode window you have to press at least 6 seconds the multimedia button from nac.
Enter first the cheatcode (for example 1130) and then the code 1122.
Repeat it with every entered code.
Example:
First -> 1130
Second -> 1122
First -> 1131
Second -> 1122
First -> 1132
Second -> 1122
And so on.
@rui.saraiva
It would be helpful if you upload the complete update package.2For those of you who want to analyze their spy logs after using code 1111, you need to install Qt (qt.io/download) and download the DLT Viewer project (github.com/GENIVI/dlt-viewer). You also need a tool to extract lz4 compressed files (e.g. github.com/lz4/lz4/releases). Once you configure everything you need to extract the .lz4 file (e.g. "1_startup_20190924_181656.dlt.lz4") which results in a .dlt file (e.g. "1_startup_20190924_181656.dlt"). You can then open this in DLT Viewer.
I assume that the Navi 5.0 is using a logger similar to the one described here: github.com/GENIVI/dlt-daemon] . Also based on the information in some of the crash reports, the Navi 5.0 seems to be using Qt apps/objects.2An old NAC Wave 2 firmware version 21.05.65.32 (early 2017), was wrongly released without any encryption. It was pulled some hours later, but it was a bit too late... I've the full update .tar file, but here's some of the interesting files, including the root filesystem, after converting/extracting - https drive (dot) google (dot) com (slash) open?id=1ocCo5WJheeBkChpydxkE1Q28UYh0Xjq92NAC Wave 2 codes (from German PSA forum)
1111 Spy log generation
1122 Master mask
1130 Information about amplifier, battery etc
1133 Information about radio / received / freq
1134 Information on satellites and services
1135 TomTom version
1136 Information about WiFi devices
1137 current user status, temp.
1138 Linux, USB, processor utilization
1139 GPU memory load
1140 connection status WiFi, tethering, Bluetooth, rndis, ipadreesen and macadressen and much more.
1141 Connected USB devices
1142 ATB connection
1143 no information without serial connection
1144 tone becomes quieter
1145 Provider status, SMS status
1146 Download status
Hope this would help
