Andream MMI Box - Wireless CarPlay & Android Auto

dkeruza · 06-22-2020, 02:18 PM

Everything would be easier if Bimmertech sell the units at a reasonable price. $650 is insane.

dkeruza · 06-22-2020, 02:24 PM

Quote:

Originally Posted by cossie1

Just a suggestion to try.

Unpack the original bin again, then repack it (without changing anything).

Then repack it with the changed xml (don't correct any md5's).

Then do a hex compare and you should find the lines in the bin file that were changed.

Then edit the original bin with that change and save it (again don't fix any md5's).

See if that works (file length should be exact still that way).

Everything is compressed, so is not possible.

muniz_ri · 06-22-2020, 02:25 PM

Quote:

Originally Posted by dkeruza

Everything would be easier if Bimmertech sell the units at a reasonable price. $650 is insane.

Agreed, I would pay a premium for the additional features, i.e. idrive call handling and higher resolution, on a BT unit but $400 more isn't worth it to me.

i3BEV · 06-22-2020, 03:04 PM

I've poked around at the bin file a bit, the squashfs images are padded with zeros which need to be preserved, so for example:

Code:

9824256       0x95E800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 4359326 bytes, 478 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:33
14186496      0xD87800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 50957129 bytes, 661 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:39
65144832      0x3E20800       Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 14657511 bytes, 120 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:53

65144832-14186496=50958336
Zero out the squashfs we modified:

Code:

dd if=/dev/zero of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 count=50958336 conv=notrunc

Reinsert the modified squashfs in the same place:

Code:

dd if=ltbmw-v2.1.0.6.lt.b/_ISPBOOOT.BIN.extracted/D87800.squashfs.new of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 conv=notrunc

However, I haven't tested this because my unit is running a different software that I don't have a image from.

darylrese · 06-22-2020, 03:08 PM

Quote:

Originally Posted by Divanovski

Hello guys,
I just signed up on bimmerpost and there are so many useful information about bmws here!

Okay, so I just installed the Andream box. Everything works good except the audio doesn't play on all of the speakers. I don't hear anything on the driver's side speakers. (Only passenger side speakers are working).
When I switch to BMW Idrive, then all of the speakers are working just fine.
Not sure what could be wrong...

I had this today when replacing my box. I pushed the main cable in hard and pulled the cable upwards and it started working from all speakers. Gently move the main harness cable and see if it comes back. Also firmly push the connectors into the box

nitsuj17 · 06-22-2020, 03:09 PM

Quote:

Originally Posted by dkeruza

Everything would be easier if Bimmertech sell the units at a reasonable price. $650 is insane.

Quote:

Originally Posted by muniz_ri

Agreed, I would pay a premium for the additional features, i.e. idrive call handling and higher resolution, on a BT unit but $400 more isn't worth it to me.

in this instance, knowing what we know now, AND if bt was selling for $400-450? sure then its worth it

based on their past history of promising widescreen support for the aa/carplay wired units and teasing it non stop on these forums (before all bt accounts were banned for various reasons) and then never delivering but just offering the wireless at a later time, that wasn't an assumption that could be made about software

granted i dont use AA so the only thing id want from bt is the click idrive wheel to skip songs in other apps; if i used AA id probably want the updates more

dkeruza · 06-22-2020, 03:10 PM

Quote:

Originally Posted by i3BEV

I've poked around at the bin file a bit, the squashfs images are padded with zeros which need to be preserved, so for example:

Code:

9824256       0x95E800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 4359326 bytes, 478 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:33
14186496      0xD87800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 50957129 bytes, 661 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:39
65144832      0x3E20800       Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 14657511 bytes, 120 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:53

65144832-14186496=50958336
Zero out the squashfs we modified:

Code:

dd if=/dev/zero of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 count=50958336 conv=notrunc

Reinsert the modified squashfs in the same place:

Code:

dd if=ltbmw-v2.1.0.6.lt.b/_ISPBOOOT.BIN.extracted/D87800.squashfs.new of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 conv=notrunc

However, I haven't tested this because my unit is running a different software that I don't have a image from.

Done that, actually my patched ISPBOOOT.BIN file wil extract fine with binwalk.
Only thing that might stop the update will be the checksum for the partition I patched.

Firefly1337 · 06-22-2020, 04:34 PM

Quote:

Originally Posted by xDHC

If you get the failed when flashing, does it brick anything?

Yes, I bricked it and only have a black screen now. Haven't had the time yet to unbrick it. Should've brought another flash drive with the original firmware, but oh well

Next time then.

Quote:

Originally Posted by i3BEV

I've poked around at the bin file a bit, the squashfs images are padded with zeros which need to be preserved, so for example:

Code:

9824256       0x95E800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 4359326 bytes, 478 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:33
14186496      0xD87800        Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 50957129 bytes, 661 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:39
65144832      0x3E20800       Squashfs filesystem, little endian, version 4.0, compression:gzip (non-standard type definition), size: 14657511 bytes, 120 inodes, blocksize: 131072 bytes, created: 2020-06-05 12:41:53

65144832-14186496=50958336
Zero out the squashfs we modified:

Code:

dd if=/dev/zero of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 count=50958336 conv=notrunc

Reinsert the modified squashfs in the same place:

Code:

dd if=ltbmw-v2.1.0.6.lt.b/_ISPBOOOT.BIN.extracted/D87800.squashfs.new of=ltbmw-v2.1.0.6.lt.b/ISPBOOOT.BIN bs=1 seek=14186496 conv=notrunc

However, I haven't tested this because my unit is running a different software that I don't have a image from.

Hm, so basically the partition (according to binwalk) is 50958336 bytes while the actual squashfs is only 50957129 bytes?
So the additional 1207 bytes are only zeroes?
If so, then theoretically we could move any subsequent partitions up by a couple of megabytes to give it a little bit more room for potential future edits.

Quote:

Originally Posted by dkeruza

Done that, actually my patched ISPBOOOT.BIN file wil extract fine with binwalk.

I didn't do that but it still extracted fine.
I just checked again and while my squashfs is the exact same size on disk, binwalk reports it a bit bigger. No idea why.

Quote:

Originally Posted by dkeruza

Only thing that might stop the update will be the checksum for the partition I patched.

Have a look at the ISP script attached to the end of the .bin file in plain text.
Alternatively I wrote a small helper script to extract it for you:

Code:

#!/bin/bash

ISP_FILE=$1;
readarray -t part <<< "$(binwalk $ISP_FILE | grep 'ISP script for ISPBOOOT.BIN' | awk '{ print $1; }')";

NAND_START=${part[0]};
NAND_SIZE=$((${part[1]} - ${part[0]}));

dd if=$ISP_FILE status=progress bs=1 skip=$NAND_START count=$NAND_SIZE of=isp_script_nand.txt

I uploaded a copy of it as attachment.
Note that there are two. The first one is for NAND flash and the second for EMMC. I would guess we have NAND, right? EMMC is for sd cards etc. But not sure, it's not really my area of expertise.

The first part of each script does the actual flash while the second part is checking the md5 sums of each partition/2MB block.
Unfortunately the relevant SPSDK squashfs partition is split to 25 parts, i.e. you need to check 25 checksums.

I couldn't really find a better way, so I wrote a small script using dd that splits a file in equal sizes:

Code:

#!/bin/bash
BINFILE="./spsdk.squashfs";

FILE_SIZE=$(wc -c < $BINFILE);
BLOCK_SIZE=2097152;

NO_FILES=$(( ($FILE_SIZE+$BLOCK_SIZE-1)/$BLOCK_SIZE ))

for i in $(seq 0 $(($NO_FILES-1))); do
        echo dd if=$BINFILE of="part$(printf "%02d" $i)" status=progress bs=1 count=$BLOCK_SIZE skip=$(($BLOCK_SIZE*$i));
        dd if=$BINFILE of="part$(printf "%02d" $i)" status=progress bs=1 count=$BLOCK_SIZE skip=$(($BLOCK_SIZE*$i));
        echo "";
done

Takes ages but afterwards you can just do

Code:

md5sum part*

and you will get all md5sums:

Quote:

2bde0e7316b367a4f9db1540fe36d918 part00
29ce0b4d68878666d02d7501336a2d4a part01
9d0592046cb970daf6f6140c24329d02 part02
29b3384d8d75ca973bd49a1cf132d49e part03
3e29856d9346cf24cf4b86dba872b3c1 part04
64e8e46acb71aca964144bbb6db915d3 part05
3076b25735569f0724d2b7fda049b31c part06
482c62bb34c3849684b78b8be266788c part07
5d2ea8c8f935ed5be998f2fc10c32edb part08
e2988357795e9be5ee81a2be8d43e8a6 part09
352c65035b615d227fbd47d05384bf15 part10
1f7cd564348a64c76aa43aa2dc027ab2 part11
b041f68a7c4f6a6489f599dd44e73bbe part12
d5ba473d7caa30f7a3094bd743abca59 part13
73da935dc6b0a87d97cf85bfc977800e part14
a4e136dac5c3d0b9348b924a74e77a29 part15
0d2be671604aaf54ef625bd68b9774a8 part16
8015ff7397496b338bf23d12c1749f0d part17
ee64b22f35e9698895c75226647aaf2c part18
52b8afbdb363e7b77f2376aa0d813cf6 part19
926b57d4f3480b875794692c88ed1100 part20
dfd64898ff6bc960006acf2655c1aff7 part21
4dd5452288aebdc11e651e289102c560 part22
184b045015dc9e6abb14748a3a09c85d part23
77340b7fa57adde3ae4ac548474725e2 part24

I am unsure about the 25th part ('part24') because of the zeroes mentioned above. I just took the raw squashfs, not the actual partition from the .bin. Perhaps that was my mistake.

But for my next try I was gonna remove the checksums entirely. The structure is as follow:

Code:

if test "$md5sum_value" = 8e87ce6413da5cfec31aba98d7117df6 ; then
    echo md5sum: OK.
else
    echo md5sum: Error!
    exit -1
fi

You could just remove/comment out the 'exit -1' if the checksum doesn't match. Then it wouldn't matter at all.

Let me know your thoughts

xDHC · 06-22-2020, 04:39 PM

Same here, bricked, black screen. Was stuck at an update loop after 50%, went back to 0% and to 50% and repeated. Unbricked it by flashing original bin file. Didnt have to pull power just put USB in and reboot the MMI, it booted into the flashing procedure.

dkeruza · 06-22-2020, 05:27 PM

Quote:

Originally Posted by Firefly1337

Yes, I bricked it and only have a black screen now. Haven't had the time yet to unbrick it. Should've brought another flash drive with the original firmware, but oh well

Next time then.

Hm, so basically the partition (according to binwalk) is 50958336 bytes while the actual squashfs is only 50957129 bytes?
So the additional 1207 bytes are only zeroes?
If so, then theoretically we could move any subsequent partitions up by a couple of megabytes to give it a little bit more room for potential future edits.

I didn't do that but it still extracted fine.
I just checked again and while my squashfs is the exact same size on disk, binwalk reports it a bit bigger. No idea why.

Have a look at the ISP script attached to the end of the .bin file in plain text.
Alternatively I wrote a small helper script to extract it for you:

Code:

#!/bin/bash

ISP_FILE=$1;
readarray -t part <<< "$(binwalk $ISP_FILE | grep 'ISP script for ISPBOOOT.BIN' | awk '{ print $1; }')";

NAND_START=${part[0]};
NAND_SIZE=$((${part[1]} - ${part[0]}));

dd if=$ISP_FILE status=progress bs=1 skip=$NAND_START count=$NAND_SIZE of=isp_script_nand.txt

I uploaded a copy of it as attachment.
Note that there are two. The first one is for NAND flash and the second for EMMC. I would guess we have NAND, right? EMMC is for sd cards etc. But not sure, it's not really my area of expertise.

The first part of each script does the actual flash while the second part is checking the md5 sums of each partition/2MB block.
Unfortunately the relevant SPSDK squashfs partition is split to 25 parts, i.e. you need to check 25 checksums.

I couldn't really find a better way, so I wrote a small script using dd that splits a file in equal sizes:

Code:

#!/bin/bash
BINFILE="./spsdk.squashfs";

FILE_SIZE=$(wc -c < $BINFILE);
BLOCK_SIZE=2097152;

NO_FILES=$(( ($FILE_SIZE+$BLOCK_SIZE-1)/$BLOCK_SIZE ))

for i in $(seq 0 $(($NO_FILES-1))); do
        echo dd if=$BINFILE of="part$(printf "%02d" $i)" status=progress bs=1 count=$BLOCK_SIZE skip=$(($BLOCK_SIZE*$i));
        dd if=$BINFILE of="part$(printf "%02d" $i)" status=progress bs=1 count=$BLOCK_SIZE skip=$(($BLOCK_SIZE*$i));
        echo "";
done

Takes ages but afterwards you can just do

Code:

md5sum part*

and you will get all md5sums:

I am unsure about the 25th part ('part24') because of the zeroes mentioned above. I just took the raw squashfs, not the actual partition from the .bin. Perhaps that was my mistake.

But for my next try I was gonna remove the checksums entirely. The structure is as follow:

Code:

if test "$md5sum_value" = 8e87ce6413da5cfec31aba98d7117df6 ; then
    echo md5sum: OK.
else
    echo md5sum: Error!
    exit -1
fi

You could just remove/comment out the 'exit -1' if the checksum doesn't match. Then it wouldn't matter at all.

Let me know your thoughts

I think we could change the ISP_Script to not do the checksum or just comment out the exit -1 lines.

Laurens0619 · 06-22-2020, 05:56 PM

Unfortunately I dont have the box but find it the analysis you are working on very interesting

Almost interesting enough to buy one haha (I just completed my id5 retrofit)

I noticed in the extracted file that there should be a shell running on the serial port:
# Start an "respawn" shell on the serial port
ttyS0::respawn:-/bin/sh

Firefly1337 I found an earlier post where you found the serial console port? did you ever tried to connect to these pins?
Or did anyone tried to connect a keyboard to the usb to send commands?

charliewaqs · 06-22-2020, 06:03 PM

Quote:

Originally Posted by Divanovski

Hello guys,
I just signed up on bimmerpost and there are so many useful information about bmws here!

Okay, so I just installed the Andream box. Everything works good except the audio doesn't play on all of the speakers. I don't hear anything on the driver's side speakers. (Only passenger side speakers are working).
When I switch to BMW Idrive, then all of the speakers are working just fine.
Not sure what could be wrong...

It must be the quad lock connector harness surely. Make sure it's properly seated and all the wires in the connectors are in fully. There are 3 wires for aux - left channel, right channel and ground and it must be related to that.

corduroy · 06-22-2020, 07:03 PM

Sorry for the question if it's been answered, but I couldn't find anything. It's just a basic question/concern. What change are you making to the XML? If it's too change it to 720p, then it might have a blank screen because that's a resolution that's incompatible with the OEM screens since they're 480p, just different horizontal resolution.

Again, sorry if it's a dumb question. You guys are awesome for looking into it!

dkeruza · 06-22-2020, 08:48 PM

Quote:

Originally Posted by Laurens0619

Unfortunately I dont have the box but find it the analysis you are working on very interesting

Almost interesting enough to buy one haha (I just completed my id5 retrofit)

I noticed in the extracted file that there should be a shell running on the serial port:
# Start an "respawn" shell on the serial port
ttyS0::respawn:-/bin/sh

Firefly1337 I found an earlier post where you found the serial console port? did you ever tried to connect to these pins?
Or did anyone tried to connect a keyboard to the usb to send commands?

It will be nice to patch it via serial, but the main goal will be to create an ISPBOOOT.BIN patched for everyone to enjoy.

07e92 · 06-23-2020, 12:50 AM

muniz_ri do you have the Andream or Carlinkit unit? I could be wrong, but I think you have the Carlinkit, just want to double check before I flash my Carlinkit with 20.06.02 from the link below.

Quote:

Originally Posted by muniz_ri

Thank you for sharing. I flashed this mcu on my Carlinkit unit and it is completely lag free. Awesome. Didn't notice any other improvements.

Quote:

Originally Posted by Jagovi

*****USE IT UNDER YOUR OWN RISK AND RESPONSIBILITY*****

BMW_NBT

MCU 20.06.02

https://mega.nz/file/ZxkyGSoY#Hqnpso...iHryKcHuoT2OIs

gpbmwe-v2.1.0.6.gpe.b:

https://mega.nz/file/wwsSAAhA#tw_eH-...jNGR2HCAYPufiQ

ltbmw-v2.1.0.6.lt.b:

https://mega.nz/file/Zk0S1QgC#prlwkJ...EK4Z6yZ5XFSdC0

muniz_ri · 06-23-2020, 01:20 AM

Quote:

Originally Posted by 07e92

muniz_ri do you have the Andream or Carlinkit unit? I could be wrong, but I think you have the Carlinkit, just want to double check before I flash my Carlinkit with 20.06.02 from the link below.

Yep, I have a Carlinkit unit. mcu 20.06.02 works great.

xDHC · 06-23-2020, 02:06 AM

Quote:

Originally Posted by corduroy

Sorry for the question if it's been answered, but I couldn't find anything. It's just a basic question/concern. What change are you making to the XML? If it's too change it to 720p, then it might have a blank screen because that's a resolution that's incompatible with the OEM screens since they're 480p, just different horizontal resolution.

Again, sorry if it's a dumb question. You guys are awesome for looking into it!

OEM screen can handle it.

xDHC · 06-23-2020, 02:46 AM

Quote:

Originally Posted by dkeruza

It will be nice to patch it via serial, but the main goal will be to create an ISPBOOOT.BIN patched for everyone to enjoy.

I think if you have serial access you don't need to mess around with bin files but just edit the required changes in VI.

Laurens0619 · 06-23-2020, 03:03 AM

Quote:

Originally Posted by dkeruza

It will be nice to patch it via serial, but the main goal will be to create an ISPBOOOT.BIN patched for everyone to enjoy.

Agree

However serial access would be helpfull to debug the update process and see where it goes wrong now

Firefly1337 · 06-23-2020, 03:17 AM

Quote:

Originally Posted by Laurens0619

I noticed in the extracted file that there should be a shell running on the serial port:
# Start an "respawn" shell on the serial port
ttyS0::respawn:-/bin/sh

Firefly1337 I found an earlier post where you found the serial console port? did you ever tried to connect to these pins?
Or did anyone tried to connect a keyboard to the usb to send commands?

Unfortunately no, I never figured out which pin goes where.
With the official SoC layout it is very easy to identify the serial pins of the chip. But on the PCB they just disappear in Via's, so it's impossible to tell where they are going.
The MCU has an empty header right next to it but also there I was only able to identify basic things like VCC and GND. And then you would only have access to the MCU, not the rest of the system.

The Indiwork manual has a nice layout on page 4 with I2C pins described on the main harness. Perhaps that could be used as an entry point.
The other cable has some undisclosed pins. Perhaps these go to the system itself?

There is an extra partition called 'runtime_cfg' that has some basic config flags e.g. which hardware ports (USB, graphical, etc) are used and in what order. There's also one that I think might enable USB OTG mode (currently it's set to '0'). But for that we need to be able to edit the .bin first...

Quote:

Originally Posted by corduroy

Sorry for the question if it's been answered, but I couldn't find anything. It's just a basic question/concern. What change are you making to the XML? If it's too change it to 720p, then it might have a blank screen because that's a resolution that's incompatible with the OEM screens since they're 480p, just different horizontal resolution.

We are not trying to change the screen's resolution, it will still stay at 1280x480. What we are trying to change is the resolution (probably more like 'quality') of AA.

xDHC · 06-23-2020, 04:40 AM

I've had confirmation from andream that they won't fix it and don't really care what others such as bimmertech do.

jacobtc · 06-23-2020, 04:43 AM

Quote:

Originally Posted by xDHC

I've had confirmation from andream that they won't fix it and don't really care what others such as bimmertech do.

Not surprising really, they will probably sell af version with "AMAZING QUALITY SCREEN ANDROID AUTO, WOW" at a later date.

06-22-2020, 02:18 PM	#2729
dkeruza New Member 14 Rep 28 Posts Drives: BMW 435i xdrive Join Date: Oct 2019 Location: Lehigh Valley iTrader: (0)	Everything would be easier if Bimmertech sell the units at a reasonable price. $650 is insane.
	Appreciate 0 Quote

06-22-2020, 04:39 PM	#2737
xDHC Second Lieutenant 94 Rep 289 Posts Drives: F20 116i Join Date: Mar 2019 Location: Europe iTrader: (0)	Same here, bricked, black screen. Was stuck at an update loop after 50%, went back to 0% and to 50% and repeated. Unbricked it by flashing original bin file. Didnt have to pull power just put USB in and reboot the MMI, it booted into the flashing procedure. Last edited by xDHC; 06-22-2020 at 05:09 PM..
	Appreciate 1 x-m4n146.50 Quote

06-22-2020, 05:56 PM	#2739
Laurens0619 New Member 16 Rep 24 Posts Drives: Bmw 320 Join Date: Feb 2020 Location: Nl iTrader: (0)	Unfortunately I dont have the box but find it the analysis you are working on very interesting Almost interesting enough to buy one haha (I just completed my id5 retrofit) I noticed in the extracted file that there should be a shell running on the serial port: # Start an "respawn" shell on the serial port ttyS0::respawn:-/bin/sh Firefly1337 I found an earlier post where you found the serial console port? did you ever tried to connect to these pins? Or did anyone tried to connect a keyboard to the usb to send commands?
	Appreciate 0 Quote

06-22-2020, 07:03 PM	#2741
corduroy Second Lieutenant 115 Rep 250 Posts Drives: '16 X5 xDrive40e (F15) Join Date: Sep 2019 Location: MD iTrader: (0)	Sorry for the question if it's been answered, but I couldn't find anything. It's just a basic question/concern. What change are you making to the XML? If it's too change it to 720p, then it might have a blank screen because that's a resolution that's incompatible with the OEM screens since they're 480p, just different horizontal resolution. Again, sorry if it's a dumb question. You guys are awesome for looking into it!
	Appreciate 0 Quote

06-23-2020, 04:40 AM	#2749
xDHC Second Lieutenant 94 Rep 289 Posts Drives: F20 116i Join Date: Mar 2019 Location: Europe iTrader: (0)	I've had confirmation from andream that they won't fix it and don't really care what others such as bimmertech do.
	Appreciate 0 Quote