Experience with 10.25" android 7.1 HU's

nomorebigideas · 06-11-2019, 11:59 AM

Quote:

Originally Posted by __fred__

No, it won't hang if you have the right MCU update. The exact string (up until the date field) must match with your unit, then it will work. If you run logcat through adb and monitor for messages, you will see why it failed. Most likely because the car ID does not match. They don't clean up the UI, so the process seems to hang. It doesn't hang, it just failed.

Photo attached - thanks so much @_fred_!!!

inzonetv · 06-11-2019, 12:27 PM

Can someone post latest px3 7.1 software? I have something from january and thought is there something newer.

__fred__ · 06-11-2019, 01:52 PM

Quote:

Originally Posted by nomorebigideas

Photo attached - thanks so much @_fred_!!!

Hmmm, that is a bit sad. I don't seem to have your version string yet (012042bJLY-CIC-HW7). Any chance you've found an mcuupdate.bin somewhere from someone with the same unit? I'll search for it myself as well.

Update: I was not able to find any other MCU updates, although there are certainly a few vendor strings like "ALS", "JLY" and "XHCN". There seems to be only one option: exploiting the firmware to be able to dump them. Now I said at first glance that it isn't easily exploited and that still stands, but there are pieces of code that I've seen that look as a target for things like buffer overflows. And now that i have a test unit with debuggable firmware, I can fuzz and test a lot faster. So please continue to send me MCU updates, but I will also try and exploit the firmware so we can dump the contents of the MCU flash memory.

nomorebigideas · 06-11-2019, 04:56 PM

Quote:

Originally Posted by __fred__

Hmmm, that is a bit sad. I don't seem to have your version string yet (012042bJLY-CIC-HW7). Any chance you've found an mcuupdate.bin somewhere from someone with the same unit? I'll search for it myself as well.

Update: I was not able to find any other MCU updates, although there are certainly a few vendor strings like "ALS", "JLY" and "XHCN". There seems to be only one option: exploiting the firmware to be able to dump them. Now I said at first glance that it isn't easily exploited and that still stands, but there are pieces of code that I've seen that look as a target for things like buffer overflows. And now that i have a test unit with debuggable firmware, I can fuzz and test a lot faster. So please continue to send me MCU updates, but I will also try and exploit the firmware so we can dump the contents of the MCU flash memory.

Any of these any good?

https://drive.google.com/folderview?id=1paJ2cyavcRH9KMQ_l5buQ2v-OB2cYFgE

nomorebigideas · 06-11-2019, 04:57 PM

Quote:

Originally Posted by nomorebigideas

Any of these any good?

https://drive.google.com/folderview?id=1paJ2cyavcRH9KMQ_l5buQ2v-OB2cYFgE

Or this?

https://drive.google.com/file/d/1gKy9DhOWXxb5RqqJXgjGqunaKVca_tnh/view?usp=drivesdk

__fred__ · 06-12-2019, 12:13 AM

First link I already have, second I asked permission. It’s not public.

nomorebigideas · 06-12-2019, 12:31 AM

Quote:

Originally Posted by __fred__

First link I already have, second I asked permission. It’s not public.

Just given - sorry about the permissions issue

__fred__ · 06-12-2019, 02:47 AM

Quote:

Originally Posted by nomorebigideas

Just given - sorry about the permissions issue

Yes, you sent me the correct file. It was 012042bJLY-CIC-HW7. I patched it. You can download it from here:

https://github.com/chinesebmwheaduni...ming%20patched

I drove to work this morning and the difference is night and day. ;-)

__fred__ · 06-12-2019, 03:50 AM

So koutsouk was so kind to send me firmware 035242bYC-CCC-HW8-190525, which is the most recent firmware I have. There is something interesting with this firmware:

They have introduced a setting to control the auto dimming feature. That means it can be enabled and disabled from android. A part of the update_settings routine writes the setting:

It's actually a frame that can be sent from android with hex bytes 0x70 and 0x13 and then 0x00 to enable or 0x01 to disable auto dimming.

There must be a corresponding settings apk somewhere in a ROM that controls the setting. This means that the Chinese do listen to their customers ;-)

I still patched the firmware for everyone who doesn't have the corresponding settings apk.

They made a mistake though. If you disable the auto dimming while your lights are on, the brightness will never return to 100%. (as night_enabled is never processed anymore). So if you have a new unit with the setting in the settings app: Do not turn off auto dimming while the lights are ON.

nomorebigideas · 06-12-2019, 04:14 AM

Quote:

Originally Posted by __fred__

Yes, you sent me the correct file. It was 012042bJLY-CIC-HW7. I patched it. You can download it from here:

https://github.com/chinesebmwheaduni...ming%20patched

I drove to work this morning and the difference is night and day. ;-)

Best Day Ever! Ty for all your hard work!

Just to check filepath for correct install:

Format FAT32

oem/mcupdate.bin

Is that right?

__fred__ · 06-12-2019, 04:20 AM

Quote:

Originally Posted by nomorebigideas

Best Day Ever! Ty for all your hard work!

Just to check filepath for correct install:

Format FAT32

oem/mcupdate.bin

Is that right?

The OEM folder is not necessary. Just in the root of the USB stick. OW, and the filename should be mcuupdate.bin. (Double u)

nomorebigideas · 06-12-2019, 04:29 AM

Quote:

Originally Posted by __fred__

The OEM folder is not necessary. Just in the root of the USB stick. OW, and the filename should be mcuupdate.bin. (Double u)

JUST UPDATED IT. Flipping Brilliant! Thank you!

__fred__ · 06-12-2019, 04:49 AM

Quote:

Originally Posted by nomorebigideas

JUST UPDATED IT. Flipping Brilliant! Thank you!

I've got another present for you:

The brightness is controllable through an android intent. Now it's a bit tricky, because its a toggle, that toggles between the 4 brightness levels:

0 = 0% brightness
1 = 33% brightness
2 = 66% brightness
3 = 100% brightness.

The intent is sent by the status bar when the button is pressed in the function area of the drop down menu. But you can ofcourse send it programmatically.

The intent is named:

com.android.quicksetting.BROADCAST

and it has extra string data attached:

msg "backlight"

You can probably toggle it from adb with the following command:

Code:

adb shell am broadcast -a com.android.quicksetting.BROADCAST 
--es msg "backlight"

Now, you don't want to do this from adb, but you could also do it with e.g. Tasker

Remember that you probably have to send multiple intents to toggle the levels with a bit of delay in between. I will create a new version of EventCenter.apk that will directly control the brightness level through an intent, but for now, this is already available.

dice66 · 06-12-2019, 05:01 AM

Quote:

Originally Posted by __fred__

So koutsouk was so kind to send me firmware 035242bYC-CCC-HW8-190525, which is the most recent firmware I have. There is something interesting with this firmware:

They have introduced a setting to control the auto dimming feature. That means it can be enabled and disabled from android. A part of the update_settings routine writes the setting:

free image upload

It's actually a frame that can be sent from android with hex bytes 0x70 and 0x13 and then 0x00 to enable or 0x01 to disable auto dimming.

There must be a corresponding settings apk somewhere in a ROM that controls the setting. This means that the Chinese do listen to their customers ;-)

I still patched the firmware for everyone who doesn't have the corresponding settings apk.

They made a mistake though. If you disable the auto dimming while your lights are on, the brightness will never return to 100%. (as night_enabled is never processed anymore). So if you have a new unit with the setting in the settings app: Do not turn of auto dimming while the lights are ON.

On my unit there is a new entry in the factory settings that handles the illumination.
There are two settings "controlled" and "uncontrolled"
I don't have the unit right now to give you the exact details but it has something to do with the reading the status from the car.
Maybe looking in the fatset.apk from the firmware I posted may shed some light.

__fred__ · 06-12-2019, 05:23 AM

Quote:

Originally Posted by dice66

On my unit there is a new entry in the factory settings that handles the illumination.
There are two settings "controlled" and "uncontrolled"
I don't have the unit right now to give you the exact details but it has something to do with the reading the status from the car.
Maybe looking in the fatset.apk from the firmware I posted may shed some light.

Pretty sure that uncontrolled will disable auto dimming.

Update:

And it does. In fatset.apk it sets a value in the sysvar.db database.

That is subsequently read in Eventcenter.Apk and sent to the unit with hex codes:

0x70 and 0x13 (= 19 decimal). 0 is controlled, 1 is uncontrolled (=autodimming disabled)

koutsouk · 06-12-2019, 05:44 AM

Quote:

Originally Posted by dice66

On my unit there is a new entry in the factory settings that handles the illumination.
There are two settings "controlled" and "uncontrolled"
I don't have the unit right now to give you the exact details but it has something to do with the reading the status from the car.
Maybe looking in the fatset.apk from the firmware I posted may shed some light.

which version firmware do you have?

nomorebigideas · 06-12-2019, 05:50 AM

Quote:

Originally Posted by __fred__

I've got another present for you:

The brightness is controllable through an android intent. Now it's a bit tricky, because its a toggle, that toggles between the 4 brightness levels:

0 = 0% brightness
1 = 33% brightness
2 = 66% brightness
3 = 100% brightness.

The intent is sent by the status bar when the button is pressed in the function area of the drop down menu. But you can ofcourse send it programmatically.

The intent is named:

com.android.quicksetting.BROADCAST

and it has extra string data attached:

msg "backlight"

You can probably toggle it from adb with the following command:

Code:

adb shell am broadcast -a com.android.quicksetting.BROADCAST 
--es msg "backlight"

Now, you don't want to do this from adb, but you could also do it with e.g. Tasker

Remember that you probably have to send multiple intents to toggle the levels with a bit of delay in between. I will create a new version of EventCenter.apk that will directly control the brightness level through an intent, but for now, this is already available.

This is too much man, I've been waiting for YEARS to get the auto dimming shit sorted and now this!?

It would great if the Tasker intent + brightness selection could be coupled with Locale/Tasker Twilight Plugin to allow for auto-dimming (conversely!) when the sun goes down etc.

__fred__ · 06-12-2019, 06:08 AM

Quote:

Originally Posted by nomorebigideas

This is too much man, I've been waiting for YEARS to get the auto dimming shit sorted and now this!?

It would great if the Tasker intent + brightness selection could be coupled with Locale/Tasker Twilight Plugin to allow for auto-dimming (conversely!) when the sun goes down etc.

This works. Twilight plugin is just a condition plugin for Tasker, so you can couple it with sending the intent and it will work. In the basis:

When going from day to night: send intent 3 times to go from 100% to 0%, 33%, 66%.

When going from night to day: send intent 1 time to go from 66% to 100%.

You might need one at boot as well if these intents don't fire while the unit was powered off. It will work better when you can send the absolute brightness value through an intent. But this will require modification of the Eventcenter APK.

dice66 · 06-12-2019, 06:36 AM

Quote:

Originally Posted by koutsouk

which version firmware do you have?

Check here https://f30.bimmerpost.com/forums/sh...php?p=24830912
20190505

koutsouk · 06-12-2019, 06:45 AM

Quote:

Originally Posted by dice66

Check here https://f30.bimmerpost.com/forums/sh...php?p=24830912
20190505

Thank you for that.
I think I need to update into that firmware to enable the auto dimming feature from factory settings.
Does this version have id7?
Do you have any photos ?

amfgray · 06-12-2019, 09:36 AM

Quote:

Originally Posted by koutsouk

Thank you for that.
I think I need to update into that firmware to enable the auto dimming feature from factory settings.
Does this version have id7?
Do you have any photos ?

yes it has id7.
yesterday i just installed it to examine id7 and as for me it is absolutely useless ;(.

Kri · 06-12-2019, 10:14 AM

Hello

I just wanted to share some information, as i got into the sideload screen by mistake by me, rebooting the device via wlan into sideload mode

After this the device is showing the first screen:

At this screen no USB device does work at all, also directly rebooting does not help to get out of the sideload screen.
I tried to connect the device to my "Android updating" laptop with adb installed via A USB A-A cable, but no success, also there is no response, the connectors seem to be not active at this boot state.

to get out of this and into the normal system you have to wait 5 minutes, after this time the second screen does appear

unfortunateley as no usb port does work its also not possible to select anything.
but the good thing is, when you now powercycle the device it will start normally into bootloader mode again

@ Fred, i`m willing to share pictures and informations of my PX6 device, i also have disassebmled is as far as i could, because i`m not using this device so i can play around with it.

i have a github account, but i`m not fimilar with the "folder" structure.

i think it would be good to start some kind of Database of the different available hardware variants / clones.
A database based on the first string of the MCUVer. (+CPU) may be the best i think, because this is the most common identification possible.
from there on built like a tree with information / pictures / how-to`s, ect ?

any hint for me to start this ?

sincerely Chri

06-11-2019, 12:27 PM	#2246
inzonetv Registered 0 Rep 2 Posts Drives: BMW E61 Join Date: Jun 2019 Location: Europe iTrader: (0)	Can someone post latest px3 7.1 software? I have something from january and thought is there something newer.
	Appreciate 0 Quote

06-12-2019, 12:13 AM	#2250
__fred__ Private First Class 50 Rep 139 Posts Drives: BMW 5 series E60, Mercedes S Join Date: Apr 2019 Location: Amsterdam, Netherlands iTrader: (0)	First link I already have, second I asked permission. It’s not public.
	Appreciate 0 Quote

06-12-2019, 03:50 AM	#2253
__fred__ Private First Class 50 Rep 139 Posts Drives: BMW 5 series E60, Mercedes S Join Date: Apr 2019 Location: Amsterdam, Netherlands iTrader: (0)	So koutsouk was so kind to send me firmware 035242bYC-CCC-HW8-190525, which is the most recent firmware I have. There is something interesting with this firmware: They have introduced a setting to control the auto dimming feature. That means it can be enabled and disabled from android. A part of the update_settings routine writes the setting: It's actually a frame that can be sent from android with hex bytes 0x70 and 0x13 and then 0x00 to enable or 0x01 to disable auto dimming. There must be a corresponding settings apk somewhere in a ROM that controls the setting. This means that the Chinese do listen to their customers ;-) I still patched the firmware for everyone who doesn't have the corresponding settings apk. They made a mistake though. If you disable the auto dimming while your lights are on, the brightness will never return to 100%. (as night_enabled is never processed anymore). So if you have a new unit with the setting in the settings app: Do not turn off auto dimming while the lights are ON. Last edited by __fred__; 06-12-2019 at 08:36 AM..
	Appreciate 1 antonius201827.00 Quote

06-12-2019, 10:14 AM	#2266
Kri Major 1084 Rep 1,048 Posts Drives: E87 Join Date: Dec 2017 Location: Germany iTrader: (0)	Hello I just wanted to share some information, as i got into the sideload screen by mistake by me, rebooting the device via wlan into sideload mode After this the device is showing the first screen: At this screen no USB device does work at all, also directly rebooting does not help to get out of the sideload screen. I tried to connect the device to my "Android updating" laptop with adb installed via A USB A-A cable, but no success, also there is no response, the connectors seem to be not active at this boot state. to get out of this and into the normal system you have to wait 5 minutes, after this time the second screen does appear unfortunateley as no usb port does work its also not possible to select anything. but the good thing is, when you now powercycle the device it will start normally into bootloader mode again @ Fred, i`m willing to share pictures and informations of my PX6 device, i also have disassebmled is as far as i could, because i`m not using this device so i can play around with it. i have a github account, but i`m not fimilar with the "folder" structure. i think it would be good to start some kind of Database of the different available hardware variants / clones. A database based on the first string of the MCUVer. (+CPU) may be the best i think, because this is the most common identification possible. from there on built like a tree with information / pictures / how-to`s, ect ? any hint for me to start this ? sincerely Chri Attached Images Last edited by Kri; 06-12-2019 at 10:59 AM..
	Appreciate 0 Quote