Всем привет,

Пытаюсь получить shell/ADB доступ к головному устройству GM.

Вот моя система и всё, что я уже перепробовал.

МОЁ ОБОРУДОВАНИЕ:

- Авто: Chevrolet Equinox 2019

- Система: gminfo3 (НЕ gminfo37 — старая система)

- Сборка: gminfo3:6.0.1/V807-895-P/152:user/release-keys/19.38.21

- SoC: TI Jacinto 6 (DRA7xx)

- Гипервизор: Xen 4.4

- Dom0: Arago Linux 4.4.14+

- DomU: Android 6.0.1

- RPO: IOR (навигация с SD-картой)

- Производитель: Harman/Becker (Aptiv/Delphi)

Инструменты:

- CH341A программатор + SOIC8 клипса + 1.8V адаптер

- FT232RL USB-to-TTL UART адаптер

- Тестовые крючки для PCB (без пайки)

ЧТО Я УЖЕ СДЕЛАЛ:

1. Проанализировал 3 пакета прошивок (SW1 v50.34.11, SW2, SW3 v53.47.01)

2. adbd = СТАНДАРТНЫЙ Android 6.0.1, НЕТ строк GMAuth в бинарнике

3. GMAuth = аппаратная блокировка через M24C64 EEPROM на модуле Renesas VIP

4. Пароли из shadow: root=пустой, delphi=delphi, user=user

5. Просканировал все порты по WiFi: открыт ТОЛЬКО DNS (53 порт)

6. FTP 9021, ADB 5555, SSH 22 — все ЗАКРЫТЫ во время работы

7. Все dnsmasq атаки провалились

8. Брутфорс GMAuth (59K+ комбинаций): НЕУДАЧА

9. Проанализировал SD-карту навигации (HERE/DENALI формат, LZ4 тайлы)

10. Нашёл SPRADG5.pdf от TI: Jacinto 7 UART = MAIN_UARTx, 115200 8N1

ВОПРОСЫ:

1. Метод EEPROM (0x441/0xA81 → 0xFF) из репозитория lvalen91/gminfo-3.7-3.8-ADB-EEPROM

работает на gminfo3 V807 (TI Jacinto 6)? Или только на gminfo37 (Intel Atom)?

2. Где именно находится M24C64 TSSOP8 на плате IOR радио?

3. Есть ли у кого-то опыт на V807-895-P?

4. После bypass ADB доступен через USB или WiFi?

5. У меня есть FT232RL — кто-нибудь знает точное расположение UART2 пинов

на PCB gminfo3/Jacinto 6? Нужен ли резистор 0 Ом для восстановления дорожки TX?

6. Можно ли через UART прервать U-Boot (2013.01, задержка 2 сек)?

Спасибо! Жду любую помощь, фото платы или подтверждение от mcOreos.

Title: EEPROM Bypass + UART Serial on gminfo3 V807 (2019 Equinox IOR) — Confirmation Needed

Hello everyone,

I'm trying to gain shell/ADB access to my car's head unit. Here's my setup

and everything I've tried so far.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

MY HARDWARE

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

- Vehicle: Chevrolet Equinox 2019

- System: gminfo3 (NOT gminfo37 — this is the OLDER system)

- Build: gminfo3:6.0.1/V807-895-P/152:user/release-keys/19.38.21

- SoC: TI Jacinto 6 (DRA7xx)

- Hypervisor: Xen 4.4

- Dom0: Arago Linux 4.4.14+, BSP c1ux_v3.16_reissue, board ngi20

- DomU: Android 6.0.1

- Radio RPO: IOR (Navigation with SD card slot)

- Manufacturer: Harman/Becker (Aptiv/Delphi)

- WiFi AP: SSID=Shim_te_ccmp, WPA2-PSK, DHCP 192.168.5.x range

Tools I have ready:

- CH341A programmer with SOIC8 clip + 1.8V adapter

- FT232RL USB-to-TTL UART serial adapter

- Test hooks for PCB probing (no-solder)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT I'VE DONE SO FAR

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

FIRMWARE ANALYSIS:

- Extracted and compared 3 GM firmware packages (SW1 v50.34.11, SW2 v50.34.11,

SW3 v53.47.01) — all are for gminfo3

- system.img.tar exists in ALL 3 packages (4GB total, 5986 ROM files)

- adbd binary: STOCK Android 6.0.1 — ZERO "GMAuth" strings anywhere in the

binary or any firmware file

- Conclusion: GMAuth is NOT in software — it's hardware-gated via the

M24C64 EEPROM on the Renesas VIP module

- Shadow file cracked from Dom0: root=empty, delphi=delphi, user=user

- Vsftpd configured on port 9021 with anonymous=YES but NOT accessible

at runtime (iptables blocks everything)

LIVE NETWORK TESTING (ALL FAILED):

- Connected to car WiFi: PC got IP 192.168.5.27, gateway 192.168.5.1

- Full port scan 1-10000: ONLY DNS port 53 open

- FTP 9021: Connection REFUSED

- ADB 5555: Connection REFUSED

- SSH 22: Closed (no sshd installed)

- UDP scan: only DNS responds; DHCP/TFTP/NTP/SNMP all timeout

- USB tether via phone: FAILED (car forces MTP mode)

- All dnsmasq attacks (Kaminsky, CVE-2017-14491, ARP+DNS): FAILED

- GMAuth brute-force (59K+ combinations): FAILED

- WiFi path = DEAD

SD CARD ANALYSIS:

- Navigation SD card uses HERE/DENALI format with LZ4-compressed tiles

- 5 verification layers identified (ECDSA .sys, MD5 .sig, VIN check, etc.)

- M3U playlist + shell script exploit attempt: FAILED (explained 7 reasons:

wrong extensions, M3U parsers don't exec shell, ro.* props immutable,

SD mounted noexec, SELinux enforcing, wrong mount path, no privilege)

- Have a test SD card ready to test if .sys signature enforcement is active

(modified version.txt, rebuilt .sig ZIP)

TECHNICAL DOCUMENTS:

- TI SPRADG5.pdf: UART Log Debug System on Jacinto 7 — confirms MAIN_UARTx

= Android/Linux console, 115200 8N1, hardware flow control (RTS/CTS)

- GM Radio Pinouts (pinoutguide.com): external harness connectors mapped —

NO UART on external pins, must open head unit

XDA RESEARCH:

- Thread "GM Google Built-In Tinkering" (gminfo37, 28 pages, 560 posts)

- UART CONFIRMED on GM HMIs (pindoura post #19) — but production boards

have BROKEN TRACES that need 0-ohm resistor solder bridge (zocs post #32)

- Tachi91 captured VIP MCU console output at 115200 baud (not Android shell)

- Y177 had permissive SELinux bug (FIXED in Y181)

- WAMS used calibration file modification to enable CarPlay on GM EVs

(discontinued after GM stopped partner dealership)

- Brian_Li claims ADB unlock for all info-series (info3.1/3.6/3.7-3.8)

but requires "professional-grade programming equipment"

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

MY QUESTIONS

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

EEPROM BYPASS:

1. Does the same 0x441/0xA81 EEPROM method from lvalen91's gminfo-3.7-3.8

GitHub repo work on the OLDER gminfo3 V807 (TI Jacinto 6)?

Or is this ONLY confirmed for the newer gminfo37/3.7-3.8 (Intel Atom)?

2. Is the M24C64 TSSOP8 easily accessible on the 2019 Equinox IOR radio PCB?

Any photos of the VIP module/Renesas chip location would help massively.

3. Has anyone specifically done this on V807-895-P build?

4. After bypass, does ADB become available via USB or WiFi (or both)?

5. Does the OnStar OTA update mechanism reset the EEPROM flags back to 0x00?

UART SERIAL:

6. I have an FT232RL adapter ready. Can anyone confirm the EXACT UART2

pin locations on the gminfo3/IOR/Jacinto 6 PCB?

7. Is the UART2 TX trace broken (like on the newer gminfo37 boards)?

If so, where exactly should the 0-ohm resistor be soldered?

8. Would UART give me a shell on Dom0 Linux, DomU Android, or the VIP MCU?

9. The U-Boot in our firmware is 2013.01 with 2-second delay — has anyone

successfully interrupted boot on gminfo3 to modify kernel cmdline?

GENERAL:

10. Between EEPROM bypass and UART serial — which gives more access

(root shell, system dump, ADB enable)?

11. Is there any way to enable WiFi ADB or USB ADB from either method?

12. Has mcOreos or anyone else on this forum done this on a 2018-2021

Equinox/Terrain with IOR radio?

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

My goal is to dump the entire system (Dom0 Linux + DomU Android), enable

ADB for sideloading/root, and replace North America maps with Middle East

maps on the navigation SD card.

This is my daily driver so I want to be 100% sure about PCB locations

before opening the head unit. Any photos, pinouts, or confirmation from

someone who has done this on gminfo3 specifically would be a lifesaver.

Thank you!

https://www.drive2.ru/l/734929241119938486/?ysclid=mqearoewpo225555850

This might be helpful