Hacking the GM HMI 2.5 module.

Lots of good Information here

https://fccid.io/ANATEL/00472-15-06541/Manual/018F8F5B-69A9-409E-AB67-4F13C8B0E8F8/PDF

https://fccid.io/ANATEL/02281-12-06541/Manual-para-referencia/BCFECE13-E51D-4609-9401-E74D6446E561/PDF

”

54 minutes ago, Miragui said:

I used Ubuntu to mount the image, but you can use any Linux distro you are comfortable with.

I used HDDRawCopy to write the EMMC image to a 32GB SD card. I used Active@ Disk Editor to view the partition information https://www.disk-editor.org/index.html

Thanks. This is truly great information.

On 9/26/2021 at 5:08 PM, Miragui said:

I have an HMI 2.5 EMMC image with reverse camera turned on, I actually want to turn it off, so maybe we can help each other out.

Do you want a copy of the 32GB EMMC dump I have? 

It has no reverse camera.

1 hour ago, Miragui said:

Sure it would be nice to compare.

Cool, I'll try and upload it to MEGA when I get some time.

On 10/4/2021 at 8:57 AM, Miragui said:

Nice, thank you. I have another question, did you manage to get your bench test setup working?

Yes I got the bench setup fully working.

I have ECU, BCM, IPC, HMI 2.5, Radio, CD player, steering wheel buttons, HVAC and HVAC controls all connected and working on the bench.

I had some issues with getting the HMI to be seen on the HSCAN line, but I got it working in the end.

Here is the mega link for the 2.5 EMMC dump I have.

When you have some time can you check and let me know if it mounts OK on your system and if you can see the files in the image?

I would like to share the commands to allow root login and enable USB support for ethernet adapter.  All of this was found by examining recovery and upgrade shell scripts in the firmware images.  There is plenty of gold for others to dig out.

Connect serial pins and interrupt boot, as I shared before.  Get to uboot prompt. Enter these commands to allow console login.

U-Boot > setenv kernelargs setenv bootargs console=${console},${baudrate} root=${mmcroot} ${cpucount} printk.time=1 ${xtargs} ${vmalloc} consoleblank=0 lpj=7905280 oops=panic panic=1 1

U-Boot > boot

When HMI has booted, press enter to open a prompt.  Enter these commands to feed watchdog and keep HMI awake for 10 minutes. 

bash-3.2# systemctl start rbcm-inc-scc-config

bash-3.2# /usr/sbin/inc_wdt 6 &

bash-3.2# /opt/bosch/base/bin/inc_send_out.out -p 50945 -b 50945 -r scc C0-00-00-02-0A

These commands will enable root login over console and ethernet.

bash-3.2# /lib/ald/security_features/kernel_console/enable_permanent.sh

bash-3.2# /lib/ald/security_features/firewall/enable_permanent.sh

bash-3.2# /lib/ald/security_features/root_login/enable_permanent.sh

bash-3.2# systemctl reboot

After HMI reboots, you will have permanent console login, without username or password.

mx6q:/home/root#

For ethernet, you will need an adapter with ASIX AX88179 chipset.  Pluggable makes a good one.  You can connect to HMI using mini-USB to USB-A adapter.  IP address can be configured with normal Linux ifconfig commands.  You can also connect the ethernet adapter to USB dashboard sockets for hacking while HMI is installed in the car.

My last gift to you is a file called eolupdatetrigger.dat.  This file is on the HMI file system, and in the SPS update files.  This text file describes the ALL the values for the calibration files. You will know what every single bit in each calibration file does.  Make sure you have backups or a good SPS USB update before you start breaking things!   eolupdatetrigger is a set of factory defaults.  Fully programmed HMIs will have different values, but  in the same format.  You can read current values from your HMI with the command /opt/bosch/gm/processes/readeol_out.out

Good luck, my friends.

2 hours ago, HMI_Guy said:

I would like to share the commands to allow root login and enable USB support for ethernet adapter.  All of this was found by examining recovery and upgrade shell scripts in the firmware images.  There is plenty of gold for others to dig out.

 

Connect serial pins and interrupt boot, as I shared before.  Get to uboot prompt. Enter these commands to allow console login.

 

U-Boot > setenv kernelargs setenv bootargs console=${console},${baudrate} root=${mmcroot} ${cpucount} printk.time=1 ${xtargs} ${vmalloc} consoleblank=0 lpj=7905280 oops=panic panic=1 1

 

U-Boot > boot

 

When HMI has booted, press enter to open a prompt.  Enter these commands to feed watchdog and keep HMI awake for 10 minutes. 

 

bash-3.2# systemctl start rbcm-inc-scc-config

bash-3.2# /usr/sbin/inc_wdt 6 &

bash-3.2# /opt/bosch/base/bin/inc_send_out.out -p 50945 -b 50945 -r scc C0-00-00-02-0A

 

These commands will enable root login over console and ethernet.

 

bash-3.2# /lib/ald/security_features/kernel_console/enable_permanent.sh

bash-3.2# /lib/ald/security_features/firewall/enable_permanent.sh

bash-3.2# /lib/ald/security_features/root_login/enable_permanent.sh

bash-3.2# systemctl reboot

 

After HMI reboots, you will have permanent console login, without username or password.

 

mx6q:/home/root#

 

For ethernet, you will need an adapter with ASIX AX88179 chipset.  Pluggable makes a good one.  You can connect to HMI using mini-USB to USB-A adapter.  IP address can be configured with normal Linux ifconfig commands.  You can also connect the ethernet adapter to USB dashboard sockets for hacking while HMI is installed in the car.

 

My last gift to you is a file called eolupdatetrigger.dat.  This file is on the HMI file system, and in the SPS update files.  This text file describes the ALL the values for the calibration files. You will know what every single bit in each calibration file does.  Make sure you have backups or a good SPS USB update before you start breaking things!   eolupdatetrigger is a set of factory defaults.  Fully programmed HMIs will have different values, but  in the same format.  You can read current values from your HMI with the command /opt/bosch/gm/processes/readeol_out.out

 

Good luck, my friends.

 

 

 

     

Great info. Thanks 😀

Hi all

SUCCESS after months searching with one friend from this forum (STACHU22), we find the way how to active touchpad on HMI2.5 add or off extra icons on the main screen, active some extra menu for any calibration, but still don't find video In motion option, any one have vin no. where that option present, or we can exchange some info,

we don't share yet how to do, because we still working on that project 

Thanks

1 hour ago, M Ch said:

Wow. That's a great breakthrough, well done.

Today I had some free time so I thought why not have another go at solving this HMI puzzle.

I was able to re-dump the EMMC chip and mount the chip's image successfully. Now I have all the HMI's application files.

One step closer to completing this puzzle/Hack 😀

33 minutes ago, Miragui said:

This is what a factory virgin unit looks like.

interesting stuff. Do you know what that install and recorder icon is used for? 

hi all

is possible to active x4 Buick themes on HMI 2.5

regards

Perfect 👍