Go Back   Jeep Garage - Jeep Forum > Jeep Platform Discussion > Grand Cherokee - WK2 - > Audio/Visual/Navigation

Join Jeep Garage Today
Reply
 
Thread Tools Display Modes
 
  #1  
Old 10-03-2011, 02:17 PM
Member
 
Join Date: Oct 2011
Posts: 7
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 939
HaTaX is on a distinguished road
Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

First of all, this is my first post here and I'll take this chance to say hello and introduce myself.

Just picked up a 2011 Overland Summit with the 430N nav system in it last week. Other car is a 2005 300C that was bought new in Dec. of 2004, so I'm a little bit of a mopar fan boy.

On my 300c I was part of a group of people that worked on the in-motion hack and actually I was responsible for developing the nag screen hack for that vehicle's REC navigation system. It was made by alpine and honestly the work on the hack wasn't too bad to do at all, just took some time and energy.

So on to the new Jeep I know I have the option of getting a lockpick system for it, but I'd also like to explore a fix from the software side of things. This way I wouldn't lose the speed indication and I wouldn't need to plug anything in to the stock system. (Not spending $250 is also a big bonus here)

I've looked around for other information and it looks like other vehicles with the MMCS have had success in bypassing some of the in-motion restrictions. Looks like they did most of their work by pulling the HDD and modifying the files that are already present on them. I've looked at the update CD that adds travel link to the system and nothing stood out as the files I would be looking for. They might actually be on that update disc, but a reference of the files that are loaded onto the HDD would be very useful for the discovery process.

I could rip the HDD out of my vehicle but I assumed others here had already done so. Any chance of one of you with the HDD out could make an image of it so I could sift through the files?

I'm not making any promises here as far as coming up with a software hack, but if I can I will and I'll provide the finished product to the rest of the group here. You can find some of my previous work on carhack.org, and I am pretty well versed in reverse engineering embedded systems. The REC had a NEC V831 CPU in it, and the current 430N has a SH-4A generation CPU, but both platforms can be disassembled in IDA easily enough.

Any takers? Just need a dump of the HDD from a 430N. (Probably would be best with no music on the HDD as well if possible)
__________________

__________________
Reply With Quote
  #2  
Old 10-03-2011, 07:39 PM
Member
 
Join Date: Oct 2011
Posts: 7
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 939
HaTaX is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

Well, I decided to just pull it out myself and have a look and I ran into a nice roadblock, the HDD in the 430N has an ATA password set on it! Just like the MMCS systems I've found information on, it has a password set in the firmware on the HDD and you can't access the data on it without that password. There's a few threads I could find out there in other forums where one person used an O-Scope to manually read the unlock password while it was fed to the HDD to unlock it. The password they found looks like it might be easy enough to guess if I can find a similar string in the update CD, but really I don't have a clue if it's going to be easy or not to locate.

Odd, the 730 and 430 appear to be VERY similar hardware wise, but it looks like the systems are quite different in this regard. I've seen other threads where people have updated their hard drives without any of the ATA password fuss, but those are the 730 devices.

Maybe I'll have to go back to the update CD and see if there's anything in there that will help this process...

Anyone attempted any hacking on the 430 system? The engineering screen would be a good place to start, but from what I've read no one has figured out how to get into it just yet on the 430...
__________________

__________________
Reply With Quote
  #3  
Old 10-03-2011, 09:12 PM
Premium Member
My Jeep: 2011 5.7L WK2
 
Join Date: Sep 2010
Posts: 43
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 1353
gsingh55 is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

I have the Lockpick already installed but a software solution would be sweet!
I know you said 430 system but my Jeep has the 730 RER and if it's as simple as replacing the HDD on my computer I'm willing to help if needed.
-G
__________________
Reply With Quote
  #4  
Old 10-04-2011, 01:00 AM
Member
My Jeep: 2011 5.7L WK2
 
Join Date: Apr 2011
Location: Rivergrove, OR
Posts: 576
Thanks: 0
Thanked 9 Times in 9 Posts
Rep Power: 10444
Andrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond repute
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

The 430N and 730N are independent engineering designs, the 430N by Mitsubishi and the 730N by Harman Becker. I don't believe the 430N has an engineering screen.

What's the make and model of the HDD in the 430N? Is the interface parallel ATA or SATA?

Is there any chance you can pull the code out of the ROM? Disassembling it might be a faster way to discover the password.
__________________
Reply With Quote
  #5  
Old 10-04-2011, 07:34 AM
ColdCase's Avatar
Senior Member
 
Join Date: Apr 2011
Posts: 1,445
Thanks: 0
Thanked 26 Times in 25 Posts
Rep Power: 26313
ColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond reputeColdCase has a reputation beyond repute
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

I know its the kind of expense you don't want to incur, but there are outfits that can recover the password for you. Its a typical forensic procedure, some drives are easier than others. I recall an individual suing a manufacture one time because the storage was claimed to be secure but a forensics outfit easily broke into the drive and gathered evidence of his illegal activity . Sometimes its just putting a data analyzer in the loop and capturing the unlock packet. That may be the easiest method if you have access to a protocol analyzer.

The radio may have an engineering/maintenance mode that alows a repair shop to replace the drive, but I suspect the replacement drive is preloaded with images and perhaps protected.

Do you know if they also encrypt the drive? That could be a bit more difficult to deal with but not impossible.

I know, I'm no help.
__________________
Reply With Quote
  #6  
Old 10-04-2011, 02:01 PM
Member
 
Join Date: Oct 2011
Posts: 7
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 939
HaTaX is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

The HDD in my 430N is an IDE/ATA interface and is made by Hitachi. It's a 40GB model that is made specifically for automotive applications, model # is: hej421040g9at00

The OS on the 430N is HP7200/MP RTOS by Renesas: http://am.renesas.com/products/tools...ct_landing.jsp

I can find lots of "interesting" things in the MAIN_APL_CPU0.mbi file (and CPU1 file) that refer to safe mode and vehicle speed, so it looks like that portion of code could be changed within that file and then push it to the 430N via the update process. The whole problem with that is that the mbi file is in a wrapper of sorts, and I would guess that the checksum for the file is also wrapped in there and would need to be discovered before it would load a modified file.

Sending the HDD off for forensics analysis is a bit too much to get something as simple as in-motion locking removed. I don't want to dump weeks / months into the project as I'd rather just go get a lockpick for the $$ to time spent ratio.

However, if I can make some progress on this, I love challenging projects and would have a hard time not tinkering at least a little. I'll have to look through the file listed above a little more to see if there's useful info in there, perhaps the password to unlock the HDD is buried somewhere inside.

If you decide to take a peek, look at the CPU1 file first as it has most of the references to vehicle speed and operation of the "safe" mode. (Assuming turning off safe mode allows in-motion use, not 100% sure of that yet)
__________________
Reply With Quote
  #7  
Old 10-04-2011, 02:46 PM
Ratchet's Avatar
Premium Member
My Jeep: 2011 3.6L WK2
 
Join Date: May 2011
Location: Wilson, NC
Posts: 398
Thanks: 5
Thanked 6 Times in 6 Posts
Rep Power: 5323
Ratchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond repute
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

How much of a PITA was it to remove the HDD? I have the RHB (no nav) unit and would be willing to pull the drive to scour some data for ya.
__________________
Reply With Quote
  #8  
Old 10-04-2011, 04:13 PM
Member
 
Join Date: Oct 2011
Posts: 7
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 939
HaTaX is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

Quite easy to pull the HDD, on the back of the unit there are two Phillips head screws and then the HDD just pulls out in a tray. However, I would expect you to be in the same boat, IE. password protected.
__________________
Reply With Quote
  #9  
Old 10-04-2011, 05:57 PM
Member
My Jeep: 2011 5.7L WK2
 
Join Date: Apr 2011
Location: Rivergrove, OR
Posts: 576
Thanks: 0
Thanked 9 Times in 9 Posts
Rep Power: 10444
Andrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond reputeAndrew Klossner has a reputation beyond repute
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

I don't suppose Mitsubishi would use the same disk password in multiple products? This post gives the password from a 2008 system.
__________________
Reply With Quote
  #10  
Old 10-04-2011, 06:57 PM
Member
 
Join Date: Oct 2011
Posts: 7
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 939
HaTaX is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

Quote:
Originally Posted by Andrew Klossner View Post
I don't suppose Mitsubishi would use the same disk password in multiple products? This post gives the password from a 2008 system.
Yeah, that's the post I had actually started with and was using it to locate a similar "string" in the firmware update files. Later down in that thread they say the string changes based on the model so I'm pretty sure ours would be different.

Just need that exact setup they've got, and we could easily get the password.
__________________
Reply With Quote
  #11  
Old 10-05-2011, 07:10 AM
Ratchet's Avatar
Premium Member
My Jeep: 2011 3.6L WK2
 
Join Date: May 2011
Location: Wilson, NC
Posts: 398
Thanks: 5
Thanked 6 Times in 6 Posts
Rep Power: 5323
Ratchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond reputeRatchet has a reputation beyond repute
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

HaTaX, I'll try and pull the HDD this weekend to see what type of security is on there. If mine is like the others and I'm assuming it is, I don't have any magic tricks I can use to pull a firmware password from it...yet. I'll shoot you a PM soon.
__________________
Reply With Quote
  #12  
Old 10-05-2011, 07:44 AM
Member
My Jeep: 2014 3.6L WK2
 
Join Date: Jun 2011
Location: New Jersey
Posts: 36
Thanks: 0
Thanked 0 Times in 0 Posts
Rep Power: 1076
marknj57 is on a distinguished road
Re: Anyone pulled the HDD out of their 430N? Willing to copy some files for me?

Strange that you have a 2011 Overland Summit with the 430N nav system.
The Summit normally comes with the 730N. Maybe your better off. The 730N has some issues.
__________________

__________________
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Best practices for loading music on 430n HDD? Cperez Audio/Visual/Navigation 48 06-30-2011 10:25 AM
album art - HDD files - 430n? 1200RT-P Audio/Visual/Navigation 7 06-29-2011 09:34 AM
Copy CDs to the 730 RHR HDD andyh Audio/Visual/Navigation 3 04-09-2011 01:00 PM

Powered by vBadvanced CMPS v3.2.3

All times are GMT -5. The time now is 02:35 AM.


Powered by vBulletin® Version 3.8.8 Beta 4
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Copyright 2012 - JeepGarage.Org
The Jeep Grand Cherokee Owners Community