try 

DiskInternals — Data Recovery Software for Damaged Partitions, RAID, NTFS, VMFS, Office etc.| DiskInternals

WWW.DISKINTERNALS.COM

---

DiskInternals official website. 15 years of data recovery software development. Recover data from a corrupted flash drive, HDD/SSD, database, email...

 

Lots of good Information here

 

https://fccid.io/ANATEL/00472-15-06541/Manual/018F8F5B-69A9-409E-AB67-4F13C8B0E8F8/PDF

 

https://fccid.io/ANATEL/02281-12-06541/Manual-para-referencia/BCFECE13-E51D-4609-9401-E74D6446E561/PDF

”

On 9/29/2021 at 10:43 AM, Troy said:

I'm able to dump the EMMC but not able to mount it.

Can you share how you mount the image for file inspection?

Which OS and which software are you using to mount the EMMC image?

 

I used Ubuntu to mount the image, but you can use any Linux distro you are comfortable with.

I used HDDRawCopy to write the EMMC image to a 32GB SD card. I used Active@ Disk Editor to view the partition information https://www.disk-editor.org/index.html

Here is a backup from the NOR from an HMI 2.5 module. Maybe it's interesting to analyse. You can see some info from the terminal output in there.

HMI GL512 8402 8494.zip

54 minutes ago, Miragui said:

I used Ubuntu to mount the image, but you can use any Linux distro you are comfortable with.

I used HDDRawCopy to write the EMMC image to a 32GB SD card. I used Active@ Disk Editor to view the partition information https://www.disk-editor.org/index.html

Thanks. This is truly great information.

On 9/26/2021 at 5:08 PM, Miragui said:

I have an HMI 2.5 EMMC image with reverse camera turned on, I actually want to turn it off, so maybe we can help each other out.

Do you want a copy of the 32GB EMMC dump I have? 

It has no reverse camera.

6 hours ago, Troy said:

Do you want a copy of the 32GB EMMC dump I have? 

It has no reverse camera.

Sure it would be nice to compare.

1 hour ago, Miragui said:

Sure it would be nice to compare.

Cool, I'll try and upload it to MEGA when I get some time.

On 10/2/2021 at 5:48 PM, Troy said:

Cool, I'll try and upload it to MEGA when I get some time.

Nice, thank you. I have another question, did you manage to get your bench test setup working?

Hi. Great info about connection to IMX6!
I successfully connected via TTL cable and look Uboot screen after 4 tap rst to gnd. But not understood how i can open ethernet connection with module for download dump and look filesystem. What is ip adress for SSH Putty i need to enter? Many thx for information.

On 10/4/2021 at 8:57 AM, Miragui said:

Nice, thank you. I have another question, did you manage to get your bench test setup working?

Yes I got the bench setup fully working.

I have ECU, BCM, IPC, HMI 2.5, Radio, CD player, steering wheel buttons, HVAC and HVAC controls all connected and working on the bench.

I had some issues with getting the HMI to be seen on the HSCAN line, but I got it working in the end.

 

Here is the mega link for the 2.5 EMMC dump I have.

When you have some time can you check and let me know if it mounts OK on your system and if you can see the files in the image?

 

 

 

I would like to share the commands to allow root login and enable USB support for ethernet adapter.  All of this was found by examining recovery and upgrade shell scripts in the firmware images.  There is plenty of gold for others to dig out.

 

Connect serial pins and interrupt boot, as I shared before.  Get to uboot prompt. Enter these commands to allow console login.

 

U-Boot > setenv kernelargs setenv bootargs console=${console},${baudrate} root=${mmcroot} ${cpucount} printk.time=1 ${xtargs} ${vmalloc} consoleblank=0 lpj=7905280 oops=panic panic=1 1

 

U-Boot > boot

 

When HMI has booted, press enter to open a prompt.  Enter these commands to feed watchdog and keep HMI awake for 10 minutes. 

 

bash-3.2# systemctl start rbcm-inc-scc-config

bash-3.2# /usr/sbin/inc_wdt 6 &

bash-3.2# /opt/bosch/base/bin/inc_send_out.out -p 50945 -b 50945 -r scc C0-00-00-02-0A

 

These commands will enable root login over console and ethernet.

 

bash-3.2# /lib/ald/security_features/kernel_console/enable_permanent.sh

bash-3.2# /lib/ald/security_features/firewall/enable_permanent.sh

bash-3.2# /lib/ald/security_features/root_login/enable_permanent.sh

bash-3.2# systemctl reboot

 

After HMI reboots, you will have permanent console login, without username or password.

 

mx6q:/home/root#

 

For ethernet, you will need an adapter with ASIX AX88179 chipset.  Pluggable makes a good one.  You can connect to HMI using mini-USB to USB-A adapter.  IP address can be configured with normal Linux ifconfig commands.  You can also connect the ethernet adapter to USB dashboard sockets for hacking while HMI is installed in the car.

 

My last gift to you is a file called eolupdatetrigger.dat.  This file is on the HMI file system, and in the SPS update files.  This text file describes the ALL the values for the calibration files. You will know what every single bit in each calibration file does.  Make sure you have backups or a good SPS USB update before you start breaking things!   eolupdatetrigger is a set of factory defaults.  Fully programmed HMIs will have different values, but  in the same format.  You can read current values from your HMI with the command /opt/bosch/gm/processes/readeol_out.out

 

Good luck, my friends.

 

 

 

     

2 hours ago, HMI_Guy said:

I would like to share the commands to allow root login and enable USB support for ethernet adapter.  All of this was found by examining recovery and upgrade shell scripts in the firmware images.  There is plenty of gold for others to dig out.

 

Connect serial pins and interrupt boot, as I shared before.  Get to uboot prompt. Enter these commands to allow console login.

 

U-Boot > setenv kernelargs setenv bootargs console=${console},${baudrate} root=${mmcroot} ${cpucount} printk.time=1 ${xtargs} ${vmalloc} consoleblank=0 lpj=7905280 oops=panic panic=1 1

 

U-Boot > boot

 

When HMI has booted, press enter to open a prompt.  Enter these commands to feed watchdog and keep HMI awake for 10 minutes. 

 

bash-3.2# systemctl start rbcm-inc-scc-config

bash-3.2# /usr/sbin/inc_wdt 6 &

bash-3.2# /opt/bosch/base/bin/inc_send_out.out -p 50945 -b 50945 -r scc C0-00-00-02-0A

 

These commands will enable root login over console and ethernet.

 

bash-3.2# /lib/ald/security_features/kernel_console/enable_permanent.sh

bash-3.2# /lib/ald/security_features/firewall/enable_permanent.sh

bash-3.2# /lib/ald/security_features/root_login/enable_permanent.sh

bash-3.2# systemctl reboot

 

After HMI reboots, you will have permanent console login, without username or password.

 

mx6q:/home/root#

 

For ethernet, you will need an adapter with ASIX AX88179 chipset.  Pluggable makes a good one.  You can connect to HMI using mini-USB to USB-A adapter.  IP address can be configured with normal Linux ifconfig commands.  You can also connect the ethernet adapter to USB dashboard sockets for hacking while HMI is installed in the car.

 

My last gift to you is a file called eolupdatetrigger.dat.  This file is on the HMI file system, and in the SPS update files.  This text file describes the ALL the values for the calibration files. You will know what every single bit in each calibration file does.  Make sure you have backups or a good SPS USB update before you start breaking things!   eolupdatetrigger is a set of factory defaults.  Fully programmed HMIs will have different values, but  in the same format.  You can read current values from your HMI with the command /opt/bosch/gm/processes/readeol_out.out

 

Good luck, my friends.

 

 

 

     

Great info. Thanks 😀

Hi all

 

SUCCESS after months searching with one friend from this forum (STACHU22), we find the way how to active touchpad on HMI2.5 add or off extra icons on the main screen, active some extra menu for any calibration, but still don't find video In motion option, any one have vin no. where that option present, or we can exchange some info,

we don't share yet how to do, because we still working on that project 

Thanks

1 hour ago, M Ch said:

 

Wow. That's a great breakthrough, well done.

Today I had some free time so I thought why not have another go at solving this HMI puzzle.

I was able to re-dump the EMMC chip and mount the chip's image successfully. Now I have all the HMI's application files.

One step closer to completing this puzzle/Hack 😀

 

 

 

Good job Troy!

This is what a factory virgin unit looks like.

33 minutes ago, Miragui said:

This is what a factory virgin unit looks like.

interesting stuff. Do you know what that install and recorder icon is used for? 

3 hours ago, Troy said:

interesting stuff. Do you know what that install and recorder icon is used for? 

Install is to install the user manual, not very interesting. The recorder button is greyed out since the unit is not in the car.

Recorder might be some kind of DVR or PDR

hi all

is possible to active x4 Buick themes on HMI 2.5

regards

 

I burned some more time on this HMI module, and today I successfully figured out how to activate and deactivate all the HMI 2.5 options. I even figured out how to activate video in motion and sat nav in motion. Video still plays while the gear stick is in drive mode. Can type in the Sat Nav address while the car is driving. 

This HMI puzzle/hack is now complete for me😀.

 

Nice!