COMBOX QNX access

[superwofy]

I will start this by saying that there is a better method (reversing the actual algorithm) but I didn't have the time or patience to figure it out. Instead, I exploited the fact that CIC and COMBOX use the same software architecture. The Combox uses essentially the same hardware as the CIC sans the Fujitsu Carmine gpu and half the RAM. If you read the HARMAN manual you will note that pins 8 (TX), 9 (RX) and 16 (GND) are UART to the SH4 chip.

Hook up a simple UART (57600) adapter to those pins and you will see debug output that is printed by a custom binary (TestMenu). However, in order to do anything fun like say, execute commands we will need to login with root access. This is the process I developed to gain access:

Press l - login to level 1 (default access) with password "COMBOX__01HB".​

Press 2 - log menu -> write to usb (pendrive plugged in to armrest).​

This creates a folder "Log_*day*_*month*_*year*__*hour*_*minutes*_*seconds*​

Get Protect.DAT from subdir HBHK and rename to "t.DAT"​

FTP into CIC and upload comboxconsole, rootpersists.DAT and t.DAT to /mnt/hbuser.
SSH into CIC and run:
chmod +x comboxconsole
./comboxconsole

Then: l - login, 6 - Show Passwords



You can now use the passwords to log in as 'root' in the Combox UART console. This will allow you to get a shell and execute commands in the Combox as if you were SSHd into it.
Why might you want this? The Combox contains the default provisioning XMLs that it falls back to if there's any issue during the provisioning update (no internet, etc.). You will need to update the IPs to point to your own proxy server. This will be relevant when I release my server VM.

 

[nsjames]

super interested in helping you out on this.

 

[doublespaces]

Damn, so after over four years of giving people access to that CIC thread someone has finally managed to bust into that thing to make the connected drive server stuff a reality? That is pretty sweet. Fantastic work!

 

[superwofy]

Damn, so after over four years of giving people access to that CIC thread someone has finally managed to bust into that thing to make the connected drive server stuff a reality? That is pretty sweet. Fantastic work!

Yes, it is finally possible. After quite a bit of trial and error. Start to finish, it took about 20 days in my spare time. I did focus quite a bit on getting 'Internet' working but this was a mistake as the portal provides exactly what I wanted - a tailored mini-website for the CIC.

I've created a LAMP VM that I will share once I've removed all development artifacts, personal information etc. I know I've promised it for a while but I honestly haven't touched it since early June.
I was a bit underwhelmed by the response but all things considered, it's a gimmick that very few people will use. Especially considering the Combox changes needed to make it 'permanent'.


Lately I've been stuck on making the JBE control both EDC and servotronic.



P.S I'm not in the private discussion.

 

[doublespaces]

Try again now. I was pretty sure I gave you access previously but you should have it now.

 

[superwofy]

Try again now. I was pretty sure I gave you access previously but you should have it now.

I can see it now, thanks. Doubt I'll be making much use of it. I do love releasing stuff publicly, free of charge, etc.
I will release the VM this weekend. Would you like me to create a new thread?

 

[doublespaces]

A new thread would be good, thanks.

 

[Deadknight]

Thanks for sharing info, not like some of the people.

 

[volaltd]

Damn, so after over four years of giving people access to that CIC thread someone has finally managed to bust into that thing to make the connected drive server stuff a reality? That is pretty sweet. Fantastic work!

There is one small problem: according to my feedback from few forums only fifteen bmw owners really interested in althernative connecteddrive server. Also CIC browser support old HTML 4 and limited JavaScript without all modern features so no possibility to make any useful web application.

 

[Digital]

I dont now about forums activity, I think these times all mowed to whatsapp, etc its because of bad responce. But in free time I am doing some cic or combox retrofis, and all clients would agree to pay reasonable fee for even live weather and search or some live news. Just for fun and new features.
I think If you manage to get working even basic, it will run and pay back with +.
And now when BMW even killed normal connected drive app for cic, this could be more interesting.

 

[volaltd]

I dont now about forums activity, I think these times all mowed to whatsapp, etc its because of bad responce. But in free time I am doing some cic or combox retrofis, and all clients would agree to pay reasonable fee for even live weather and search or some live news. Just for fun and new features.
I think If you manage to get working even basic, it will run and pay back with +.
And now when BMW even killed normal connected drive app for cic, this could be more interesting.

I made working basic weather and internet 5 month ago and here was offer to try it for free:

Anyone thought of building a connected drive server?

This is what I already implemented at my own server. Works for CIC+Combox via customer mobile over Bluetooth and via ECALL with local SIM card. I can provide content for some forum members who is able to code CIC and Combox to work via customer mobile and load provisioning using tool32 without...

www.spoolstreet.com

 

[Digital]

When I asked for test, you answered, that got all info and not available for now. And If product is ready to use, then I think need to offer in public forums.

 

[volaltd]

Just checked and your message doesn't have VIN, email and messenger info for realtime communication. Looks like you're first class person and expecting lot of my time personally asking you for required info and then you will need guide and support. Surprise, but it doesn't work this way!

And one more thing: for sure your combox customers "for fun and new features" will pay not more then 5$/month but expecting first class service with voice call center, but commercial development of news, apps and call center for most countries and languages will cost me around 50$/month per customer. Did you ever hear terms "business plan" and "marketing research of the market" ? As always from your garage workshop you know better how to take money from my pocket

Main goal was to learn modern ASP .NET Core, EntityFramework, get weather on iDrive for me personally - successfully done. And I'm sharing service for free to users who understand real cost and able follow direct instructions.

Good luck spending time in whatsapp!

 

[Digital]

I sent you vin in CT forum, you answered "Rewriting app to get internet working". Following all these forums and didnt see any other info. I now how much cost development, and free time, no problem with reasonable price for this service.
I am not asking you all that for 5$/month, and your style off communication is far from business. You spend time&money for this product, you say your price, no problem about that, who want this service that will pay.

 

[volaltd]

I sent you vin in CT forum, you answered "Rewriting app to get internet working". Following all these forums and didnt see any other info. I now how much cost development, and free time, no problem with reasonable price for this service.
I am not asking you all that for 5$/month, and your style off communication is far from business. You spend time&money for this product, you say your price, no problem about that, who want this service that will pay.

Smile, there was no offer on CT so you failed second time

I see only one-two persons who would resell cool toy to their local customers with 10-20$ commission and pushing anybody who appears to make that toy. If customers reject to pay high price, then you lose nothing, those stupid IT guys pay all risks and even for web hosting. That your plan, correct?
It's make me laughing because you get your 100$ only in case stupid enough somebody make work cost around 5000-10000$. It's very difficult work to be inspirer and sallary not so pretty in compare to DevOps!

My price is nothing more then end user good enough to configure his car and not spending my time to void speaks while trying to make business on my product. This is 100% not you

 

[noydoc]

Try again now. I was pretty sure I gave you access previously but you should have it now.

Any chance of getting access to that forum?

 

[rhodesman]

WOW! Nice! I'm so glad someone was able to figure this out! I lost interest a while back due to the complexity and time needed was more than I could handle. This post has re-inspired my interest and will possibly pick this back up again! Nicely done @superwofy

 

[JonEQuest]

So what would this add as far as features? Would you be able to browse the net or use Google maps instead of the horrible BMW navigation? I swapped the CCC in my 2008 335i with a a CIC unit and added combox, etc to get BT audio, multi button controller, etc. I have resisted the urge to just swap in an Android unit because I have the Locic 7 with MOST system and want to the high quality audio.

 

[volaltd]

So what would this add as far as features? Would you be able to browse the net or use Google maps instead of the horrible BMW navigation? I swapped the CCC in my 2008 335i with a a CIC unit and added combox, etc to get BT audio, multi button controller, etc. I have resisted the urge to just swap in an Android unit because I have the Locic 7 with MOST system and want to the high quality audio.

For now it allow just root shell access in combox with wires and we have promise for free VM to show custom webpages in CIC. Features development takes lot of time and can be free only for a short demo period

 

[superwofy]

For now it allow just root shell access in combox with wires and we have promise for free VM to show custom webpages in CIC. Features development takes lot of time and can be free only for a short demo period

Yes it does, with the singular purpose right now of replacing dpas_00*.xml with your own proxy IP.
I spent about a month's spare time (Most of it I wasted with the mv2trace and bin) on this project between early June and the end of June when I essentially parked it. There wasn't that much interest in it and I do have a full-time job.

Here are detailed screenshots of what I built anyway. Code hasn't changed since Jun 30 bar for a move from Apache to Lighttpd yesterday.
I will release this with a Github repo that will contain the up-to-date web code and in the repo I'll link to the VM I run locally since I doubt many people will want to go through the whole hassle of installing. This makes the most sense to me.

I am considering a small lightsail instance but I just know it'll get DDoSd to shit.