• Welcome to Ecoboost Performance Forum. Please log in or sign up.
collapse

Trying to hack SYNC

Started by nickstewartroc, August 10, 2015, 10:08:09 PM

Previous topic - Next topic

nickstewartroc

I finally got some time to work on the method I posted in the "OEM CarPuter - Data Logging and Pi: conceptual discussion" thread (the drive swap method). I didn't seem to want to work though, whether I swapped or just plugged in the drive, it still would show up as un-initialized in disk management. The drive does indeed have an ata password on it. Being a Hitachi though, there isn't much out there on a master password. The only one I could find of 32 spaces did not work. I might see if there is a way to brute force the password or try to use a logic analyzer on it. A couple interesting things I noticed is that the radio will still function without the drive, however in a "Fault detected, please see dealership" message and no real gui, and that if I just plugged in a random 2.5 44 pin IDE drive, the radio will sit at the Hello screen for a while before going to fault detected, almost like it was trying to read the data off the drive. I will try to keep this updated as I go, I am sorry if this is in the wrong section, I have no idea where else to put it!
-Nick

EDIT:
So here is what I have come up with. Using a 44 pin IDE extension cable [http://www.ebay.com/itm/280504781985?_trksid=p2060353.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT] You can separate four of the pins that provide power to the drive. This would be on the male side. I used a straight blade, like you would find in a scraper. I lined it up and hit it with a hammer hard enough to split the connector. From here, I also snipped the reset line, as this would send the reset signal to the drive every time I would plug it in, effectively re-locking the drive. At this point, you need something you can plug a 44 pin ide cable into, in my case it was an old Dell D600. You'll only need to plug in the part of the connector that was separated (the 4 pin piece) into whatever you are using, whether it be an old laptop, or some sort of adapter such as a 2.5->usb. From here, you can plug the other part of the connector into the stock head unit. The easiest way to do this is to remove the head unit from the car, remove the mounts on both sides and remove the front cover. Also, go ahead and remove the hard drive. Now from the front of the head unit, you will see the connect circuit board that the drive plugs into. Remove the phillips screws on both sides, and bend down the metal at the bottom so that the board will pop out. Now go ahead and plug the head unit back into the car and all the cables on the back. Now get ready to unlock the drive. Get yourself setup so that whatever you are using to power the drive is close to the head unit, and plug the data cable into the connector board you just popped out. The easiest way to think about it is how the OEM drive slid in and plugged in, and basically picture how it would be plugged in as you flip up the connector to be able to plug in. Now keep in mind that the cable was cut, so you need to count the 4 pins that were separated (When I say 4 pins, I mean two on the top and two on the bottom, like a box) and make sure to plug in the cable so that those four are empty. At this point, you will need to power on your means of power then the head unit. Go ahead and play a song from the harddrive (or go ahead and rip one if you don't have any) while it is playing or ripping a track, unplug the data cable and plug it into your adapter (NOTE: you may have to power it with the head unit and swap the data connector to your adapter, I didn't get to test with my 2.5->usb as it broke before I could use it) and from here, you will have access to 4 partitions each formatted FAT32.

Upon some further investigation, even though the OEM drive is locked, you can replace it with a non-locked drive. This is what I did: I made a Ghost (Norton Ghost) image of the OEM drive while unlocked. When the image was done, I swapped into my D600 another 2.5 drive, this one was also a Hitachi (only because it was the only one I had on hand). Now the OEM drive is 40GB, the hitachi I tested with was 30GB. So from here, I used Ghost to restore the image to my 30GB drive (Ghost is nice since it will auto resize, I have no idea if it is possible with CloneZilla). When it was finished, I popped it into the headunit, and it worked just fine! I was able to play the one track I ripped and load maps just fine. So you should be able to take any 2.5 IDE (NOTE the IDE) drive, image it, and toss it in. This is great for a few reasons. 1: If your drive is toast, now you can replace it. 2: You might be able to get a larger drive, image it and have more room to rip cd's. 3: You can probably get a better drive (the stock drive is 4260 RPM) so you might be able to get a 7200RPM drive and have the system be faster overall. 4: You might also be able to get a 2.5->SOMETHING (such as to flash, or even sata) and have it work. And 4: If someone figures out what to do with the image, it would be easily modifiable for anyone to put it on a drive and pop it in instead of going through the whole unlocking ordeal.

CloneZilla Set:

The 9 part set is finished uploading. It is a set of 9 .7z's that extracts to a main .7z  The 9->1 is about 8.5 GB, and the 1->final extract is about 37GB. The final extract is the complete disk image made with CloneZilla, however I recently finished using Ghost to create an image if anyone ends up needing it in a different format

Link 1
Link 2
Link 3
Link 4
Link 5
Link 6
Link 7
Link 8
Link 9


Ghost Set:
Set of 13 Ghost files, 12 are 2GB, one is 137MB. This is the set I used to restore to a different drive.
Link 1
Link 2
Link 3
Link 4
Link 5
Link 6
Link 7
Link 8
Link 9
Link 10
Link 11
Link 12
Link 13

VHD Set:
This is a set of 9 .7z files, which will extract to a single VHD file
Link 1
Link 2
Link 3
Link 4
Link 5
Link 6
Link 7
Link 8
Link 9
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

vernonator

So is your idea to put a bigger drive in to replace the OEM drive?
2012 Tuxedo Black SHO w/PP. Livernois Stage 4+, PPE Catless DP's, EBC Stage 4 Front/Rear Brakes
2015 Tuxedo Black Explorer Sport 401A, no mods....YET :)

nickstewartroc

At this point is more of just seeing what I can do. I know its running on basically Windows CE as the OS. I know a lot of things have been disabled such as using a keyboard or a mouse, and it would be cool to be able to re-enable it. It would also be pretty cool to put a larger drive in, however I don't even use the space that it has now... Being able to replace a drive would be beneficial in the future I am sure. It would also be great to be able to run custom code on it. Until I can see what is on the drive though, I don't even know what is possible. I might end up getting the password for the drive and find it is in some format I can't read. I have a feeling it is in TFAT as that is what some of the Microsoft Automotive information says, but who knows...
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

J-Will

This is good stuff, and I am very interested in what you find out. 

I'd love to swap out this drive, and throw in my own running Win 10 in tablet mode!  That would be significantly more functional and open for customization. 
2014 Factory Order SHO (non pp) Deep Impact Blue
Gearhead Automotive Performance Tune
3-bar
SP-542 plugs w/ GH gap

J-Will

Do you have more info on the model of drive it is? 

I'm reading online that HD Doctor for Hitachi works to unlock ATA passwords, but only for certain model drives.
2014 Factory Order SHO (non pp) Deep Impact Blue
Gearhead Automotive Performance Tune
3-bar
SP-542 plugs w/ GH gap

nickstewartroc

Alright, I managed to get the drive unlocked and am currently making an image of the entire drive. It is split into 4 partitions, and look to be fat32. I ended up doing the swap method, however I had to modify it slightly. When I did the swap method with my Xbox years ago, it was simply leaving the power plugged into the console, rip a cd to the harddrive to make sure it is unlocked, unplug the IDE cable and plug the drive into your computer leaving the Xbox on powering the drive. I tried doing it very similar to that, however the drive remained locked. I switched from an external usb->ide adapter to using an old Dell D600 with an IDE port. I bought a 44 pin IDE extension cable (it HAS to be an extension cable, make sure it was the wires twisted at one end) and cut the connector to separate the four power pins and the data pins. What I didn't know at first was that the reset line needed to be cut, otherwise when you plug in the drive, it would reset causing it to lock. The end I separated the power on is the end that plugs into the laptop. I plugged the power into the D600, then the data into the OEM head unit. To do this, I took out the headunit from the car, and removed the front cover and removed the drive from the back. When you look into the headunit, you will see the small circuit board that the drive plugs into. Two phillips head screws and it should come out. You might have to bend the bottom tab some. Plug in the cable to it, you will need to use the hard drive as a reference of where to plug it in and what orientation. So now you should have the data part of the cable plugged into the head unit, the power in the laptop, and the other end into the hard drive. From here, I first powered on the laptop, then I powered up the car and played a previously ripped song from the drive. While it was playing, I removed the data cable and plugged it into the laptop. I was using a live cd with CloneZilla on it to make the image and save it. I will see what I can do digging around on the image, and see what I can do about trying to upload it somewhere (Anyone know where I can upload 38GB?)
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

BiGMaC


•2013 Taurus SHO nonPP - All Ford factory options, 3BAR MAP, LMS v8 tune (mods for 3BAR, DPs, and T-stat), Paint & plastic correction, CQuart finest all exterior surfaces, limo black window tint,VLED Triton switchbacks, Daytime BrightLites switchback DRLs, full interior and exterior LED conversion, Lamin-X charcoal blackout tail lights and reflectors, PPE catted and coated downpipes, EBPP coated hotpipes with BoVs VTA, MDesign CAI
•2013 F250 CC Lariat 6.7EB Diesel -stock

nickstewartroc

Doesn't look like Dropbox will have enough space, I'll keep looking though. As far as the data, there isn't much that is human readable. Hopefully someone will be able to do something with the data, in the meantime, I am going to try to clone the image to another drive without locking it and see if the head unit will read it.
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

setaonivek

definitely interested in this .. 
'15 SHO, PP, WPM

nickstewartroc

I am currently uploading the image to Mega. It is a set of 9 .7z's that extracts to a main .7z  The 9->1 is about 8 GB, the 1->final extract is about 37GB. The final extract is made with CloneZilla, however I recently finished using Ghost to create an image if anyone ends up needing it in a different format. I am also currently using the ghost image to "restore" to another drive, albeit smaller (30gb instead of 40gb) to see if sync will read a non-locked drive.
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

nickstewartroc

Alright, I updated the original post with my findings, as well as the process and the disk image. I am still working on uploading them, and will try to update the original post as they finish uploading.
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

nickstewartroc

All "images" are uploaded, I will work on uploading actual images that I took of the head unit, laptop, hard drive, etc.
Current:
2013 Ruby Red Flex Limited EcoBoost, Unleashed Tuned, drop in filter

Gone but not forgotten: 2011 SHO Non-PP in Black Tuxedo Metallic - Catback, DPs, Stoptech Z23s, MDesign CAI, LMS Tune

jmr061

Quote from: setaonivek on August 16, 2015, 12:49:02 PM
definitely interested in this ..

Remember he is working with a 2011....totally different system than a 2015 has.
Jason
16 Edge Sport

FoMoCoSHO

Quote from: jmr061 on August 18, 2015, 07:43:41 PM
Quote from: setaonivek on August 16, 2015, 12:49:02 PM
definitely interested in this ..

Remember he is working with a 2011....totally different system than a 2015 has.
Not sure what he's looking to do but this might be of help...

http://lockpickair.com/mytouchair.htm

J-Will

Have you been able to turn your image into a VM?  This should allow you to pull out any drivers in order to create a custom image (Win 10 or bare CE)
2014 Factory Order SHO (non pp) Deep Impact Blue
Gearhead Automotive Performance Tune
3-bar
SP-542 plugs w/ GH gap