Skip to content
View in the app

A better way to browse. Learn more.

www.CameraLoops.ru

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Hacking the GM HMI 2.5 module.

I'm on a quest to hack the GM HMI 2.5 module to learn more about its functionality.

This article is a placeholder for future findings and experiments.

GM HMI 2.5 EMMC Chip Pinouts for dumping the HMI 2.5 Emmc Micro Chip

For dumping the contents of the HMI 2.5 module's EMMC chip, which stores the Sat-Nav maps, calibration files and other operating files.

 

To be continued 

IMG_5021 (3).jpeg



User Feedback

Recommended Comments

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
1 hour ago, xGhost said:

IPC? For what? Need I connect BCM?

IPC is part of the MOST BUS. and the bcm i'm not sure, but probably.

in my bench i have bcm too

Miragui Top Member

+Miragui

+Contributor
  • Contributor
12 hours ago, xGhost said:

IPC? For what? Need I connect BCM?

My bench setup doesn't have an IPC connected. I do have a BCM so I can do VIN programming on the HMI and Silver box. 

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

For my simple Setup i don't use IPC or BCM. Only HMI, Silverbox and Display.

 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
10 minutes ago, Robikiller 1 said:

For my simple Setup i don't use IPC or BCM. Only HMI, Silverbox and Display.

 

yes, it works, in several times i bypassed the IPC Most bus, and works. but the steering wheel controls do strange things. in bench, no problem hahaha

 

image.png.7b5542542a554abe805fd574d0810da9.png

 

 

xGhost Explorer

+xGhost

+Contributor
  • Contributor
1 hour ago, Robikiller 1 said:

For my simple Setup i don't use IPC or BCM. Only HMI, Silverbox and Display.

 

Ok. How you wake up modules?

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

Over Power Button on the Display and for the HMI X1-5 HIGH for Programming etc.

Andreia Pereira Lemes Rising Star

Andreia Pereira Lemes

Member
1 hour ago, Robikiller 1 said:

Sobre o botão liga / desliga no display e para a HMI X1-5 HIGH para programação, etc.

Hello, could you give more details? A picture would be nice.
Sinusshephard Rising Star

Sinusshephard

Member
On 8/10/2022 at 7:07 PM, Troy said:

I burnt some more time on this HMI module and today I successfully figured out how to activate and deactivate all the HMI 2.5 options. I even figured out how to activate video in motion and sat nav in motion. Video still plays while gear stick is in drive mode. Can type in Sat Nav address while the car is driving. 

This HMI puzzle/hack is now complete for me😀.

IMG_6235.jpgIMG_6237.jpg

 

How did you do it?I purchased a 2.5 HMI for my 2013 Cadillac ATS and was wondering how to upgrade cause I get a theftlock screen.

Troy Grand Master

Troy

Administrator

GM Car Hacking Expert

On 11/19/2023 at 4:57 AM, Sinusshephard said:

How did you do it?I purchased a 2.5 HMI for my 2013 Cadillac ATS and was wondering how to upgrade cause I get a theftlock screen.

 

Hi, you can use the GM DPS software and special DPS file to remove the theft lock from the HMI. More info can be found in the weblink below.

 

 

Info on activating various features in the HMI 2.5 can be found at the weblink below.

 

 

 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
On 10/27/2022 at 9:26 PM, Arbe_gtc said:

someone has archieved the uboot mode in the hmi 2.5? im trying but...

 

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1

TBB-gd41017e #1
# INFO SW=GMG3G_LINUX_15.1A044 GMG3_AUTOSAR_15.0C06.12 
mDNSResponder: mDNSResponder (Engineering Build) (Jun  8 2015 17:59:40) starting
mDNSResponder: mDNS allowed interface: cplay
mDNSResponder: mDNS disallowed interfaces: none(disabled)
mDNSResponder:   6: Listening for incoming Unix Domain Socket client requests
mDNSResponder: mDNS_AddDNSServer: Lock not held! mDNS_busy (0) mDNS_reentrancy (0)
mDNSResponder: mDNS_AddDNSServer: Lock not held! mDNS_busy (0) mDNS_reentrancy (0)
mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 101 (Network is unreachable)
Creating zram swap with 300 MBytes
khd: Looking up config value for key 'key_store'
khd: Key store path: /var/opt/bosch/dynamic/keyman/key_store.

khd: Looking up config value for key 'listen_socket'
khd: Server listen path: /var/run/khd/listen.

khd: Reading disc store file
khd: Number of keys on disc: 1
Created zram swap with 300 MBytes
# INFO HIT NOT Enable/Available

 

the system boots normaly

Solved.

 

I have a CONSOLE in HMI:

 

image.png.c9d98bf2dae6e8585264f8e54a7d4d66.png

And SSH access wia WIFI

 

image.png.058f714f6280fd5c7105acca2aa1b9b8.png

 

Winter is cooming 🤣

 

 

THANKS @HMI_Guy

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

How did you get ssh working? Unfortunately i get only serial to work. 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor
4 hours ago, Robi_X said:

How did you get ssh working? Unfortunately i get only serial to work. 

launch netstat -an and check if the port 22 is listen in 0.0.0.0

image.png.31d4bfa865aca26c9bb9e3e3346cb14d.png

 

I have connected the HMI via wifi menú (enabled with calibrations)

 

image.jpeg.744b7720ffdd38e40b6d7d0237be61f8.jpeg

 

 

. with ASIX AX88179 chipset ethernet adaptor, works too. the HMI in ETH0 have this address by default: 172.17.0.1  mask 255.255.0.0

image.png.e69aa680f47c72d9aa632a3191aa4ab8.png

 

and you can connect via ethernet: (configure the pc address in the same range 172.17.0.2 255.255.0.0 for example

image.png.f9954d8f8b569452b1a524e53ecb28dd.png

 

 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

Someone with ssh/console access can check the permissions of this files/folder?

 

I need know the permissions of all, because i delete all folder, and i restored it, but now the "shop" application not working OK. and i think mising permissions or a symbolik link.

After the error message "Cant connect", if i click settings, nothing happens and should appears a menu

If someone can check it.

 

image.png.5b20f24528173f38d4126853e5a1518b.png

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

Do you mean that?

 

image.png.ccd16f973c11c5012566fe8b8f780c31.png

image.png.42d72c3665c46abf82c8a39eb5124f24.png

 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

i means all folders and files in the folder "2"

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor

This?

image.png.f03b511b4c783e942fdf66014c3d5c41.png

image.png.5407cfb69f7f86a4f6591d366dc58543.png

image.png.4e00a24492829459c257107e89bd417e.png

GMLib:

image.png.f1e3821fd209003315905c3f6f6fb83b.png

image.png.f58ec4b9827a63ffdd3625c0480c87ee.png

 

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

yes!! but i need the permissions of the files user group, user owner... attribs

Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

@Robi_X with this command you can do it

 

ls -lR

Robi_X Collaborator

+Robi_X

+Contributor

GM Car Hacking Expert

  • Contributor
Arbe_gtc Rookie

+Arbe_gtc

+Contributor

GM Car Hacking Expert

  • Contributor

Well, well... it seems to work. LOL

 

 

 

 

BLKATSG Collaborator

+BLKATSG

+Contributor

GM Car Hacking Expert

  • Contributor

Great job.  I like the night mode version 🙂

Thomas Crosbie Apprentice

+Thomas Crosbie

+Contributor
  • Contributor
On 1/15/2025 at 5:35 AM, Arbe_gtc said:

News:

 

 

Amazing work!

 

Do you have a rough guide for this? Would love to give it a go myself. 

Nicholas Trambitas Apprentice

+Nicholas Trambitas

+Purchaser

Great work guys!! I will have to examine the dump files but I'm really interested to see if it's possible to change the GM "bong" chimes to something else... I'm assuming that this is stored on the HMI unit right? It would be fun to be able to inject my own chimes and personalize the car a bit. I'm curious if anyone has tried this yet.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Add a comment...

All Articles

Popular Members

  1. hassan77h
    +hassan77h
    27
  2. Troy
    Troy
    22
  3. uglyoldbastard
    +uglyoldbastard
    13
  4. regloops
    +regloops
    8
  5. GM-Enthusiast
    +GM-Enthusiast
    7

New Members

  1. David Fontenot
    David Fontenot
      Member
    Joined
  2. SSAUTOZ
    SSAUTOZ
      Member
    Joined
  3. valdemarford
    valdemarford
      Member
    Joined
  4. Course faycal khalil
    Troll-Course faycal khalil
      Troll-Troll
    Joined
  5. Troll stevie nick
    Troll-Troll stevie nick
      Troll-Troll
    Joined
  6. Troll Parkerchevy
    Troll-Troll Parkerchevy
      Troll-Troll
    Joined
  7. Hayk Vardanyan
    Hayk Vardanyan
      Member
    Joined
  8. tunedbycasco
    tunedbycasco
      Member
    Joined
  9. freehugs
    freehugs
      Member
    Joined
  10. ceberon
    ceberon
      Member
    Joined

CameraLoops™
Powered by Art
All Trademarks appearing on this website are the property of their respective owners.

Account

Navigation

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.