Solution for 'Version unmatch' (I hope final) - MTCD Android Head Units General

I know that this topic has already been discussed many times in many threads (most in MTCD - Verified Cross compatible MCUs).
I also know that there is a known solution to this problem.
However, there are users who report that they still have a problem with that.
I am writing a new thread to present (I hope) the final solution "Version unmatch"
Remember.
The solution presented in the MTCD - Verified Cross compatible MCUs thread still applies:
1. Before uploading new MCU (dmcu.bin), first export your settings to the dmcu.cfg file (FactorySettings, button Export)
2. After uploading new MCU, restore your dmcu.cfg (file dmcu.cfg on SD card, then MCU Update)
Below is the link to the application that unlocks the device from "Version unmatch"
Code:
https://www.sendspace.com/file/ijmf13
This is Android app so you must install it on your device.
After install and run you should see screen similar to that:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Press UNLOCK button. After you should see notifaction like below:
Reboot your unit.
After that, "Version unmatch" should gone

vote for sticky!

Works great!
thank you

Wadzio said:
I know that this topic has already been discussed many times in many threads (most in MTCD - Verified Cross compatible MCUs).
I also know that there is a known solution to this problem.
However, there are users who report that they still have a problem with that.
I am writing a new thread to present (I hope) the final solution "Version unmatch"
Remember.
The solution presented in the MTCD - Verified Cross compatible MCUs thread still applies:
1. Before uploading new MCU (dmcu.bin), first export your settings to the dmcu.cfg file (FactorySettings, button Export)
2. After uploading new MCU, restore your dmcu.cfg (file dmcu.cfg on SD card, then MCU Update)
Below is the link to the application that unlocks the device from "Version unmatch"
Code:
https://www.sendspace.com/file/ijmf13
This is Android app so you must install it on your device.
After install and run you should see screen similar to that:
Press UNLOCK button. After you should see notifaction like below:
Reboot your unit.
After that, "Version unmatch" should gone
Click to expand...
Click to collapse
Very good work, Thanks

how to restore dmcu.cfg?
I place in root of drive before upgrade but was ignored.
I changed from LM to HA and had to manually set display and touch key settings
I had this version unmatched problem and was solved with the tool. thanks

For me, the version unmatch tool crashes every single time. Anyone else experience this? What to do now?!?!

Heard of anyone having an issue with their unit crashing when trying to run the app? Mine does. I even reinstalled it several times and even after a full restore, it still crashes. I have an H201.

does this app requires root ? can you please elaborate a little as how this app works ? as the app is not working it asks for reboot and comes back to menu.

Try to manually reboot. Go to the factory settings menu and type hctreboot (step 10).

same for me, Android 10 ,it crash everytime , there is an update ?

same issue , on Android 10 it crashes everytime

laptopmd said:
same issue , on Android 10 it crashes everytime
Click to expand...
Click to collapse
Yes I think a number of people have reported that. Keen to figure it out?

I'm proud to announce that i've found a way to disable that "version unmatch" by modifying the dmcu.img file. It has worked 3 times with 3 different files so i can confirm it work.
Without boring you with the details, what i've done was :
1. decompress the img file with mtcdmcutool , you obtain a dmcu.bin file.
2. open and decompile the file with Ghidra (see screenshot)
3. here i've found where the software check if the version is "unmatch" (by searching the strings into the file).
4. just before you can see a check (cmp param1,#0x0) and a jump in case it doesn't match (beq , etc etc..) , those strange words is called "assembler language".
5. at the end, simply re-compress the files into a valid dmcu.img file, and update your mcu like always.
My simple solution was to force that parm1 value to 0 , to do that i've modified the code from CMP to MOV param1,0x0 and so the jump happen everytime and you don't get the annoying message and the continuous "beep" of the autoradio. I'm actually using my android radio without issues.

laptopmd said:
I'm proud to announce that i've found a way to disable that "version unmatch" by modifying the dmcu.img file. It has worked 3 times with 3 different files so i can confirm it work.
Without boring you with the details, what i've done was :
1. decompress the img file with mtcdmcutool , you obtain a dmcu.bin file.
2. open and decompile the file with Ghidra (see screenshot)
3. here i've found where the software check if the version is "unmatch" (by searching the strings into the file).
4. just before you can see a check (cmp param1,#0x0) and a jump in case it doesn't match (beq , etc etc..) , those strange words is called "assembler language".
5. at the end, simply re-compress the files into a valid dmcu.img file, and update your mcu like always.
My simple solution was to force that parm1 value to 0 , to do that i've modified the code from CMP to MOV param1,0x0 and so the jump happen everytime and you don't get the annoying message and the continuous "beep" of the autoradio. I'm actually using my android radio without issues.
Click to expand...
Click to collapse
Hey, can you upload mtcdmcutool somewhere?
I can't find it anywhere!

Fakken said:
Hey, can you upload mtcdmcutool somewhere?
I can't find it anywhere!
Click to expand...
Click to collapse
You didn't searched really... it is all on this forum
This is the thread : https://forum.xda-developers.com/an...dification-t3745838/post75471198#post75471198

Try to download the file there

Fakken said:
Try to download the file there
Click to expand...
Click to collapse
So use google, he answered with this link : http://www.tehnari.ru/f180/t266132/
It's in russian but you can see the file link, tried and it work.
I don't want to upload it here without the permission of the developer.

Thank you, i don't know if you believe me, but if searched alot to find the file. I even translated the 4pda.ru to search it.
Eh, thank you very much!

i got "error reading a file!" in mtcdmcutools while trying to convert it to .bin file.
how do i go from here? im using a stock dmcu.img file from xtrons.

In my case it says "illegal system!" additionally to the "Unmatch" Banner.
The Tool crashes right after it is opened, my touch screen only works on the upper slide part and there are no "Car Settings" in the Settings anymore..
Any idea what to do there?

Related

[Guide] How to Add Arabic / Persian / Hebrew support to your Kaiser

Hi everybody. I will explain the process here, it is fairly easy
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Here is what you’re going to need:
1.Fonts/Language support: this is the most important part. I took the required files for Arabic support from this site
http://code.google.com/p/arabicandroid/downloads/list
all credit goes to Mr. alsanad for his great code
Persian and Hebrew seem to work fine with the font I'm using right now, but I can read both, so I can't say it's 100% working.
Persian: you may want to play with it a little, maybe add newer fonts later by yourself.
Hebrew: when I search Google I found only fonts for Android 1.5. however if you find the fonts, the process should be the same
anyway, the Arabic font package I am using right now apparently can display Hebrew characters...
2.7-Zip or any program that can create “tar” files
Please note that the fonts you get in most of the cases are made for HTC android devices in mind, not for WM devices. And they require recovery mode and other stuff (I can’t explain a lot because I don’t own Android device). So we’re going to convert the file, and make it suitable for our devices.
Steps:
1.Get the fonts file and extract the content to whatever place you like
In the case of Arabic, you should see two folders:
PHP:
META-INF
System
2.Select the folders, and right click on them, them choose 7-Zip > Add to Archive
3.Make sure you choose archive formate as “tar”
4.Name the file “androidupdate” and save
5.Copy the file to you SD card: put in andboot folder
6.Installing the update: I quote this from “How to replace Windows Mobile with Android”
Place the SD card in your phone and power on your Kaiser. When you see text on your screen hold down the D-pad. D-pad is that button in the center of your up, down, left, right buttons. Keep holding down the D-pad until you see something like this appear on your screen.
Click to expand...
Click to collapse
7.Choose install update: you will see then some lines and then word Installing.
8.When finished, choose quite, or soft rest.
9.You’re done
Make sure you choose the right font for your Android. Apparently each version of android requires some modifications.
You might want to add some specific keyboard. I recommend Smart Keyboard... it is super fast, very accurate, and has support for different languages, such as Arabic and Hebrew.
I tried these steps on Kaiser running VaniljEclair RLS7c with the latest kernel.
I know this guide is basically unpacking, renaming, then installing... But it might be a little hard for some people..And I hope it will help them.
Make sure you back up you date or whatever important information you have on your phone and SD card before you start.
I have uploaded the files I used for my device. these fonts are meant for android 2.1
Cheers
Duke that has got to be the best timed guide I've ever seen, just finished making up a hebrew fonts update for shar1r, lol
Excellent guide, this deserves a sticky, since it is a question that has been asked before, and will be again
I usually edit an existing androidupdate.tar using 7zip, but this method is more complete, ( my method is mostly a lazy hack ).
Awesome!! I just posted a question about this - and voila this great tutorial!
Thank you!!
Sure, no problem. glad I can help
first i gotta tell u this thread is cooool
and thank u for ur effort
but i gotta a porblem
which is first of all i couldn't download the file cuz i'm in syria and google doesn't allow to download from it
i tried ultrasurf
but the same thing happened
anyway i found that u uploaded the files that u use
and u use vaniljeclair as i do
i did the update
but it still giving me error and repeat the same lines before boot
i use vaniljeclair too but rls11 not rls7c
does it has anything to do with it??
-sorry for the long speech lol-
i appreciate ur help
and one more thing
i searched for rls7c but i couldn't find it cuz it always reach for the rls11
thank u again
peace..
man_77 said:
first i gotta tell u this thread is cooool
and thank u for ur effort
but i gotta a porblem
which is first of all i couldn't download the file cuz i'm in syria and google doesn't allow to download from it
i tried ultrasurf
but the same thing happened
anyway i found that u uploaded the files that u use
and u use vaniljeclair as i do
i did the update
but it still giving me error and repeat the same lines before boot
i use vaniljeclair too but rls11 not rls7c
does it has anything to do with it??
-sorry for the long speech lol-
i appreciate ur help
and one more thing
i searched for rls7c but i couldn't find it cuz it always reach for the rls11
thank u again
peace..
Click to expand...
Click to collapse
If the guide isn't working for you then you can always try a multi language build. I know both Scoot and I keep our multi language Cyanogen 6.1 based builds updated. You might want to look towards those.
Link in 1st post doesn't seem to be working for me either.
Yet i think you should change the title of the thread, something like:
How to add YOUR language to a build
Also:
man_77 said:
first i gotta tell u this thread is cooool
and thank u for ur effort
but i gotta a porblem
which is first of all i couldn't download the file cuz i'm in syria and google doesn't allow to download from it
i tried ultrasurf
but the same thing happened
anyway i found that u uploaded the files that u use
and u use vaniljeclair as i do
i did the update
but it still giving me error and repeat the same lines before boot
i use vaniljeclair too but rls11 not rls7c
does it has anything to do with it??
-sorry for the long speech lol-
i appreciate ur help
and one more thing
i searched for rls7c but i couldn't find it cuz it always reach for the rls11
thank u again
peace..
Click to expand...
Click to collapse
Avoid return key, learn to use space. For a moment i thought i was reading a poem...
the coder apparently switched from Google code. here is the new website
http://ardoid.com/
I would recommend using generic Froyo libs as they might work. I don't have my TyTN II anymore... all my testings are on HD2.
http://ardoid.com/?p=64
most of the mutlilang builds will have native support for Arabic/Persian fonts, however, they won't look connected.
you migh need to use "libskia.so" and/or "libwebcore.so" only in this case.
Adding language support is trail and error, so give yourself plenty of time before trying this out.
I am using the libs for the Desire HD on my HD2 and they work perfectly fine.
And yeah, you can try a program called Tor www.torproject.org or Hotspot Shield www.hotspotshield.com to change your IP address.

[APP][Update to any Firmware region via Kies2.0][SpoofFw][Kies2.0]

A new approach!
Spoof the firmware version on the device, to trick Kies2.0.
But as you might understand, messing with system files is always dangerous and the possibility for a brick is always present. Hopefully this will not occur I'm doing my best to avoid that.
You should not use this app if you cannot get into Recovery and/or Download mode! (3 button combo) As always when you modifies system files!
Remember to disable any lagfix before updating!
For everyones safety I would recommend doing a manual backup of /system/build.prop and the complete /efs folder including nv_data.bin
The app does this automatically to the internal SDCARD, but just to be on the safe side I would recommend a manual backup to the computer aswell.
There is three steps where a reboot is required after step 2. The app will tell you what to do.
Step1.
Backup everything. If this fails, step2 is not available.
Step2.
Set the new ProductCode and PDA. Reboot!
Step3.
Set CSC and Phone. Do NOT reboot. Connect to Kies2.0 and update!
This setting is not permanent and will go back to previous setting after reboot.
Remember to disable any lagfix before updating!
Done!
-------------------------------------------------------------
How to Restore
Press restore in the menu. Reboot required.
If something fails, please send me your logcat.
So here it is: SpoofFw - requires ROOT and BusyBox
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Online Market link
If you get problems to connect to Kies after you used this program, try remove the registry key "HKEY_CURRENT_USER\Software\Samsung\Kies\DeviceDB"
Please let me now if it works out for you.
If you like my work, please consider a small donation.
Thanks a lot for your patch
Hi,
I'm new to the forum and am very interested in your work, at the moment the file to "fool " Kies 2.0 has not worked for me. I have the version 2.2 of Android 9000XWJPB/I9000FOPJP3/I9000XXJPP/I9000XWJPB and product code FOP. Sorry for my english, i'm from Spain.
what is new in this ??
It does'nt entirely work. Tried and it shows me update available.
But when it supposed to start downloading new rom, it say that latest software is already installed in my phone.Then Kies resets and start over offering update again.
So, I guess it detects the real rom in the phone.
Nice patch, though. Maybe you can see what is the problem.
Thanks
Same here - I just posted in the "original" theme about kies registry patcher.
Kies finds update, and when i start upgrading, the phone disconnects, and then after 1s reconects back. I cannot upgrade.
oh crap. didnt try to actually download it. thought it would work. I'll have a look at it. sorry guys.
No panic
Obviously some can upgrade, some cannot. We are the first with this problem.
I have jpx. Could this cause problems?
Those of you who have tried the patch, can you please post your info from the registry and tell me if it worked or not. Include both product code, hidswver, softwarerevision and modelname.
For me, in the registry is still JPY everywhere, after apply patch.
PRODUCT code : GT-I9000HKDXEU
HIDSWVER: I9000XXJPY/I9000OXAJPY/I9000XXJPY/I9000XXJPY
Model Name:GT-I9000
Software Revision: I9000XXJPY/I9000OXAJPY/I9000XXJPY/I9000XXJPY
HTH....
Running Kies 2.0.0.11014_49
HIDSWVER I9000XXJPO/I9000OXAJPO/I9000XXJPP/I9000XXJPO
Product Code GT-I9000HKDTMU
Model Name GT-I9000
Doesn't work unfortunately - it offers me an upgrade, appears to download the file then gives the Disconnected error.
I've also tried manually editing the registry as per kies 1.5 but no more luck.
I've tried on 2 PCs too.
HIDSWVER: I9000BUJP7/I9000GVD2JP5/I9000BUJP5/I9000BUJP7 (SofwareRev is same)
FW: I9000BUJP7/I9000GVD2JP5(CSC)/I9000BUJP5(modem)
PCode: GT-I9000HKDVD2 (VD2)
Kies: v2.0.0.11014_49
OS: Win7 Ultimate 64bit
I checked my registry but to no avail. Also tried deleting DeviceDB key to force kies into reconstructing it. It doesn't offer the fw upgrade option at all.
At least it's good to know someone is trying to develop a way to spoof kies 2.0. Did the patch work with any previous versions of kies 2.0?
I just got some another idea: could we try to hack ProductCode on device instead of on Kies side?
AFAIU ProductCode == CSC. I've googled we can change CSC in following ways:
1) *#272*HHMM# on Android 2.1 and older
2) *#272*IMEI# on Android 2.2 and newer
3) Opening preconfing with ADB
4) Editing /efs/nv_data.bin
Would it make Kies detecting different ProductCode?
There is still one more thing we have to consider: what if Kies detects our changed ProductCode but also firmware versions that were never released for given ProductCode?
Zajec5 said:
I just got some another idea: could we try to hack ProductCode on device instead of on Kies side?
AFAIU ProductCode == CSC. I've googled we can change CSC in following ways:
1) *#272*HHMM# on Android 2.1 and older
2) *#272*IMEI# on Android 2.2 and newer
3) Opening preconfing with ADB
4) Editing /efs/nv_data.bin
Would it make Kies detecting different ProductCode?
There is still one more thing we have to consider: what if Kies detects our changed ProductCode but also firmware versions that were never released for given ProductCode?
Click to expand...
Click to collapse
I have thought about it too. But we still need to change the PDA and PHONE aswell. But I have not yet located where they are stored. My guess is it's hard coded somewhere. Still the drivers need to take it from somewhere, the question is where.
LuffarJoh said:
I have thought about it too. But we still need to change the PDA and PHONE aswell. But I have not yet located where they are stored. My guess is it's hard coded somewhere. Still the drivers need to take it from somewhere, the question is where.
Click to expand...
Click to collapse
There is something like
getBasebandVersion, but I can't track RILRequest, how is is reading RIL_REQUEST_BASEBAND_VERSION... That could show us some file with baseband version maybe.
I have had some progress.
I have managed to change all necessary codes in the phone to be able to spoof Kies. This time I passed the step that the patch didnt!
Unfortunately it's not that simple, it requires root and changes system properties. But it's all reversible. I think I'll try to make an app of it during next week. First is a final exam on Monday.
watch this space.
well, it's much more fun to develop android application then study for an exam
I have successfully switched from XEN to XEE and to DBT.
I'm almost done, just some more bug testing. I'll probably release it tonight
Good news, wait for your release tonight.
luffarjoh said:
well, it's much more fun to develop android application then study for an exam
i have successfully switched from xen to xee and to dbt.
I'm almost done, just some more bug testing. I'll probably release it tonight
Click to expand...
Click to collapse
great news!!!
I have to push the release until tomorrow, I still have some fine tuning to do! Overall is works very well

[tool][31/10/2012][NEW VERSION] ModernBack changer 2.8

Hi, I've developed another tool for Windows 8.
This tool is named "ModernBack changer". With this tool it's possibile to change accent colors and background image from default themes or with a custom image.
This tool work only on Windows 8 RTM and it need administrator rights.
UPDATED 31/10/2012 !!!
New 2.8 version: important bugfixs and restyling
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Official article (read this before downloading please!)
Direct download
Pasquiindustry said:
Hi, I've developed another tool for Windows 8.
This tool is named "ModernBack changer". With this tool it's possibile to change accent colors and background image.
This tool work only on Windows 8 RTM and it need administrator rights.
This is the first version and maybe there will be some small bugs. I have find no one
Link awesite article
Link application download
Any feedback is welcome
Click to expand...
Click to collapse
Can you actually select your own backgroud image for the Modern start screen? If so i will give this a try tonight and let you know if there are any issues. Thanks for your work on this i am not the biggest fan of the preset backgrounds.
With a program it's very difficult, because there is a system file to edit. I'll give a try
I think too that the default backgrounds are bad
Doesnt work. Started with Admin rights, I can change the accent color but not the background
Build 9200 RTM
@AsakuraVN Have you installed a LP?
@All I find a solution to edit a startscreen background with custom background. After some test, developing and more test, maybe i can bubblish the new version with this function.
Pasquiindustry said:
@AsakuraVN Have you installed a LP?
@All I find a solution to edit a startscreen background with custom background. After some test, developing and more test, maybe i can bubblish the new version with this function.
Click to expand...
Click to collapse
If it works then I crown you a legend
There are some problems with imageres file.
I have do this manually (the problems are the image format, depth and color and maybe Resource hacker...)
Here there's a screenshot http://dl.dropbox.com/u/54377272/screen.png
Pasquiindustry said:
@AsakuraVN Have you installed a LP?
@All I find a solution to edit a startscreen background with custom background. After some test, developing and more test, maybe i can bubblish the new version with this function.
Click to expand...
Click to collapse
You mean a language pack? Then no, Im using a clean install of RTM. Might try again later
Looking forward to your new version with custom background though xD
The 2.0 version is almost finished. I need some tester before publish, because the editing of imageres.dll wasn't much stable (though the problems was resolved). One never know
Please contact me with a MP to test the application.
Thanks and sorry for the bad english
Thanks! I can't wait to try it out - V2 that is.
Sent from my Nexus 7 using xda premium
ModernBack changer was update to 2.0 introducins new graphics, small functions and customizable background with a custom photo.
Need feedback (good or bad )
Tried this out of curiosity, but the start background image never changes, even though it says it should?
the_scotsman said:
Tried this out of curiosity, but the start background image never changes, even though it says it should?
Click to expand...
Click to collapse
Some users can't change their background or accent color or twice with this tool...
I'm trying to find a solution (this problem came from 1.0 version...)
What version of Windows 8 have you tried? Have you got a language pack installed or your windows 8 is in another language than en-US?
Have you started it as administrator or have you restarted your pc and re-tried to edit background? Is your PC activated?
Sorry for a lot of question, but i have no idea of this problem...
Pasquiindustry said:
Some users can't change their background or accent color or twice with this tool...
I'm trying to find a solution (this problem came from 1.0 version...)
What version of Windows 8 have you tried? Have you got a language pack installed or your windows 8 is in another language than en-US?
Have you started it as administrator or have you restarted your pc and re-tried to edit background? Is your PC activated?
Sorry for a lot of question, but i have no idea of this problem...
Click to expand...
Click to collapse
Im running RTM Pro x64. No laguage packs installed Language/Region is English-Australia.
I tried running as administrator. Tried reboot too.
PC is not yet activated.
I'm getting this
___________________________________________
ERROR in
action number 1
of Other Event: User Defined 0
for object sceltaimmagine:
Error in code at line 5:
background_xscale[0]=room_width/background_width[0]
^
at position 34: Division by 0.
____________________________________________
Also resource hacker displays about 4 error massages one after the other .
Right after I select a image.
Running windows pro 32bit.
the_scotsman said:
Im running RTM Pro x64. No laguage packs installed Language/Region is English-Australia.
I tried running as administrator. Tried reboot too.
PC is not yet activated.
Click to expand...
Click to collapse
Maybe I've found the problem, I'm working for an update
punkmonkey1984 said:
I'm getting this
___________________________________________
ERROR in
action number 1
of Other Event: User Defined 0
for object sceltaimmagine:
Error in code at line 5:
background_xscale[0]=room_width/background_width[0]
^
at position 34: Division by 0.
____________________________________________
Also resource hacker displays about 4 error massages one after the other .
Right after I select a image.
Running windows pro 32bit.
Click to expand...
Click to collapse
Maybe the image selected was heavy and Irfanview (the tool included thatconvert images) didn't convert the image on-time. I will incrase the image converting time.
Working on ModernBack changer 2.5
New 2.5 version aviable for download!
Thanks for the new version, everything seems to go well (no errors) but I can't seem to see any change's after I reselect the modified theme.
What am I doing wrong?
punkmonkey1984 said:
Thanks for the new version, everything seems to go well (no errors) but I can't seem to see any change's after I reselect the modified theme.
What am I doing wrong?
Click to expand...
Click to collapse
Thy this:
select a default theme and open the start-screen
return to desktop
select the custom theme and re-open start-screen
If this don't apply the custom background, look to \windows\system32 folder if "imageres.backup" is present
Maybe there are problems with permission of rename imageres.dll.
Read this new article about troubleshooting http://goo.gl/WbzCS
Pasquiindustry said:
Thy this:
select a default theme and open the start-screen
return to desktop
select the custom theme and re-open start-screen
If this don't apply the custom background, look to \windows\system32 folder if "imageres.backup" is present
Maybe there are problems with permission of rename imageres.dll.
Read this new article about troubleshooting http://goo.gl/WbzCS
Click to expand...
Click to collapse
Thanks I'll give that a try and report back, thanks for the support.:good:
EDIT: Can't seem to get imageres.backup file to appear in system32 I followed your guide you linked me to but can't get it to create imageres.backup

OneUI 3.0 beta for G975U1 out now (update.zip link added)

Didn't see a thread, but I just checked the Members app and saw the OneUI 3.0 beta registration was finally on there for G975U1. Registered and am downloading now.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Links:
BETA 1 - Android 10 ETJ3 -> ZTKI Update.zip link ( courtesy of @GreenDinoXD )
BETA 2 - ZTKI -> ZTL9 Update.zip link ( courtesy of @GreenDinoXD )
Rename .bin file to update.zip
Follow installation instructions from this thread:
Kapitein187 said:
ADB-method:
1. Download SDK platform tools from here https://developer.android.com/studio/releases/platform-tools
2. Extract them on your desktop.
3. Inside the extracted folder put the update.zip
4. Inside this folder, holding left shift, right click the mouse and select "open command prompt here". The command prompt will open.
5. Shutdown the phone.
6. Holding power+volume up buttons, enter into recovery mode.
7. Select "update via ADB". (you scroll down using the volume buttons and select using the power button).
8. Connect the phone to the PC using original samsung USB cable.
9. In the command prompt run the following command:
./adb devices
10. Wait to see that the daemon has started and that your device is found.
11. If you device is found, run the following command:
./adb sideload update.zip
The update process will start. You will see a percentage counting. First it will verify, then patch etc. Do not move the cable, disconnect the phone or power off the PC.
Once the process is completed (it takes some time) the phone will boot itself, update the apps and log into your home screen.
SD-card method:
1. Download the bin file and rename it to update.zip (by going to file options in win10 you can select to view the file extensions. This makes the renaming process much easier and safer, and avoids renaming the file to update.zip.zip)
2. Copy it to the root directory of your SDcard.
3. Shut down your phone.
4. Hold simultaneously Power+volume up buttons to get into stock recovery.
5. Using your volume keys navigate to "update via SdCard" and press power button to select it.
6. Again using volume keys navigate to the file "update.zip" and press power button to select it.
7. Update will start. Leave it till it completes. It will take some time.
8. Phone will reboot by itself and load android.
Click to expand...
Click to collapse
How to capture the update.zip file to share with other people:
1. Download HTTP canary app from playstore
2. Open HTTP Canary app
3. Start the update by pressing "download" and don't pause it
4. Go back to canary app and start it and it will grab the link for you
rikipy said:
How to capture the update.zip file to share with other people:
1. Download HTTP canary app from playstore
2. Open HTTP Canary app
3. Start the update by pressing "download" and don't pause it
4. Go back to canary app and start it and it will grab the link for you
Click to expand...
Click to collapse
Is it still possible to grab the link after it's finished downloading? It's finished but I haven't installed it yet.
jeston said:
Is it still possible to grab the link after it's finished downloading? It's finished but I haven't installed it yet.
Click to expand...
Click to collapse
Just redownload it.
Hello, please post update.zip file
please do you have the update.zip file , please share the link
is it for snapdragon?
Good day, anyone was able to download the zip file? My CSC is XXA. I tried to do the trick of taken out my sim card and restarting my phone to see the notice come up in the members app but cannot enrol because I do not have a us simcard in my phone.
Ackeem.Salmon said:
Good day, anyone was able to download the zip file? My CSC is XXA. I tried to do the trick of taken out my sim card and restarting my phone to see the notice come up in the members app but cannot enrol because I do not have a us simcard in my phone.
Click to expand...
Click to collapse
That's not how this works, unfortunately.
Some people END UP with Snapdragons outside US, i have a friend who i recently found out was on PIE.
It's logical that SIM Region and Actual Location match up.
The only way we can alleviate this is by finding out a way to spoof requests to Samsung's Servers (alla Frija) for OTA's with mocked locations, but i've never seen something like that.
That said, Snapdragon Beta testers seem to be as helpful as Samsung is to them, so far none of them have shared the package with us.
PlutoDelic said:
That's not how this works, unfortunately.
Some people END UP with Snapdragons outside US, i have a friend who i recently found out was on PIE.
It's logical that SIM Region and Actual Location match up.
The only way we can alleviate this is by finding out a way to spoof requests to Samsung's Servers (alla Frija) for OTA's with mocked locations, but i've never seen something like that.
That said, Snapdragon Beta testers seem to be as helpful as Samsung is to them, so far none of them have shared the package with us.
Click to expand...
Click to collapse
okay please if you hear any please let me know .. and thanks so much am grateful
I tried a manual Frija fetch with OP's information, just for the sake of it, and got some interesting results.
This is the latest XAA Android 10 Build in Auto shows:
SM-G975U1_1_20201020093603_5lxag3hh7k_fac.zip.enc4
So build date is 20th October 2020. And this is ETJ3 (November).
Manually looking up for XAA with:
PDA: G975U1UEU4ZTKI
CSC:G975U1OYM4ZTKI
Phone: G975U1UEU4ZTKI
Gives me this:
SM-G975U1_7_20201112155200_rpfk7uveqc_fac.zip.enc4
So, build date is 12th November 2020. Build Date and release dates can differ up to two-three weeks. Weirdly though it reports Android 7.1.1 (which this device never had).
OP (@jeston ) Can you just check if the build date matches with yours in Software Information?
PlutoDelic said:
I tried a manual Frija fetch with OP's information, just for the sake of it, and got some interesting results.
This is the latest XAA Android 10 Build in Auto shows:
SM-G975U1_1_20201020093603_5lxag3hh7k_fac.zip.enc4
So build date is 20th October 2020. And this is ETJ3 (November).
Manually looking up for XAA with:
PDA: G975U1UEU4ZTKI
CSC:G975U1OYM4ZTKI
Phone: G975U1UEU4ZTKI
Gives me this:
SM-G975U1_7_20201112155200_rpfk7uveqc_fac.zip.enc4
So, build date is 12th November 2020. Build Date and release dates can differ up to two-three weeks. Weirdly though it reports Android 7.1.1 (which this device never had).
OP (@jeston ) Can you just check if the build date matches with yours in Software Information?
Click to expand...
Click to collapse
Looks like the build date is November 30...
I can't be the only one in the beta, nobody else has been able to join and grab the update.zip?
jeston said:
Looks like the build date is November 30...
Click to expand...
Click to collapse
That's nice news, why is Frija able to download a November ROM when there isnt one built in that month (As i said, November release was built in October).
I could never do this before with Beta's or Test Firmwares on SamFirm or Frija, why is it suddenly reacting to the exact values of the Beta is a myth to me.
jeston said:
I can't be the only one in the beta, nobody else has been able to join and grab the update.zip?
Click to expand...
Click to collapse
There are quite a few on reddit, but no one sniffed the package. Bummer.
jeston said:
Is it still possible to grab the link after it's finished downloading? It's finished but I haven't installed it yet.
Click to expand...
Click to collapse
yes its still posible and me on insta: Mateuzs_95 so i can help you with the steps:
PlutoDelic said:
That's not how this works, unfortunately.
Some people END UP with Snapdragons outside US, i have a friend who i recently found out was on PIE.
It's logical that SIM Region and Actual Location match up.
The only way we can alleviate this is by finding out a way to spoof requests to Samsung's Servers (alla Frija) for OTA's with mocked locations, but i've never seen something like that.
That said, Snapdragon Beta testers seem to be as helpful as Samsung is to them, so far none of them have shared the package with us.
Click to expand...
Click to collapse
I actually get updates my latest being last month.
PlutoDelic said:
That's nice news, why is Frija able to download a November ROM when there isnt one built in that month (As i said, November release was built in October).
I could never do this before with Beta's or Test Firmwares on SamFirm or Frija, why is it suddenly reacting to the exact values of the Beta is a myth to me.
There are quite a few on reddit, but no one sniffed the package. Bummer.
Click to expand...
Click to collapse
I guess they were quite hasty so nobody thought about grabbing the update
I really hope someone grabs the update and upload the zip. Waiting for 3 months to get a feel of android 11 is just out of it.
Ackeem.Salmon said:
I really hope someone grabs the update and upload the zip. Waiting for 3 months to get a feel of android 11 is just out of it.
Click to expand...
Click to collapse
the guy that created this post can do it right know but i don't know if he want to do it. i can help him but he needs to contact me so i can tell him the steps
BETA 1 FOR G975U1.
Install guide found here I believe. I did not create that guide. I am not responsible for what you do with the file, I just grabbed it cause it seems people needed it.
GreenDinoXD said:
BETA 1 FOR G975U1.
Install guide found here I believe. I did not create that guide. I am not responsible for what you do with the file, I just grabbed it cause it seems people needed it.
Click to expand...
Click to collapse
Can anybody confirm that's the correct update.zip before I include the link in the OP?

Toyota Map Update Hacking Help

Hi everyone,
I'm looking for a little help modifying the ToyotaHMIMainSWUpdate.swf to skip the activation check when updating the maps.
So far I've managed to skip the screen where you enter the activation code and I'm able to select which maps I want and progress to the confirmation screen.
After pressing confirm I get the message saying "Radio will reset to complete the update" and then it either kicks me back to the previous screen or jumps back to the beginning with a message saying "I'm working on it...", any help is appreciated.
Here's a link to the unmodified file:
File on MEGA
mega.nz
Making modifications to the swdl and swdlInstall ISOs isn't an issue as I'm able to rebuild them with a valid signature.
It appears it's the nav-activation.lua and not the ToyotaHMIMainSWUpdate.swf file which needs to be modified. The swf must just act as a front end to the lua script.
After patching the activation check in the lua file and rebuilding the ISO I was able to sucessfully bypass the activation screen and the unit rebooted as it should after selecting which maps I wanted to install.
The problem I now have is that the ISO fails the secondary signature check when trying to validate against the embedded signature.
This is how the beginning of one of the ISOs looks.
The part marked in green is a digital signature created from a list of all the files and folders in the ISO file, along with some additional information about them.
The part in blue is a SHA-256 hash created by reading chunks of 32768 bytes.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The part in green is verified by the following commands:
inject -e -i /fs/usb0/swdl.iso -f /tmp/isodigest.sha256 -o 0 -s 64
isodigest -df /tmp/iso.digest /fs/usb0/swdl.iso
openssl dgst -sha256 -verify /etc/keys/swdl.pub -signature /tmp/isodigest.sha256 /tmp/iso.digest
Click to expand...
Click to collapse
If successful, you will get "Verified OK"; otherwise, you will get "Verification Failure."
The part in blue has to match the output created by hashFile:
hashFile sha256 /fs/usb0/swdl.iso /tmp/tmp.digest 32768
Click to expand...
Click to collapse
I'm able to pass the verification checks for the parts in green and blue, but I can't seem to figure out how the part in red is generated, as the verification step then fails when verifyISO is run after the unit is reset before the updates are actually installed.
If we can figure out what the parts marked in red are, then we may be able to generate fully customizable updates.
It looks like the blue and red parts are base64 encoded and passed to com.harman.service.samSecurity as json in the following format:
{
"signType": "appUpdate",
"signature": "base64 encoded value"
}
Click to expand...
Click to collapse
The last character is also removed after it's been base64 encoded
Hi,
I'm trying the same.
Do you have any updates after the last message you send?
Can't we decode the activation code instead?
@willmav5000 Which system are you currently investigating?
Because I am looking for Toyota Touch & Go 2 system (MM17/MM19)
Do you find the ToyotaHMIMainSWUpdate.swf in the KWI update file?
I find a Russian website where KWI unpacker tool is available:
Курим KIWI
club-lexus.ru
Файловый архив
It seems to support KIWI 1.22 format, does it compliant with Toyota Touch & go 2 system?
Thanks.
lelapindelaforet said:
@willmav5000 Which system are you currently investigating?
Because I am looking for Toyota Touch & Go 2 system (MM17/MM19)
Do you find the ToyotaHMIMainSWUpdate.swf in the KWI update file?
Click to expand...
Click to collapse
I'm currently looking into the Toyota Touch & Go 2 MM16 system.
jobdbr said:
Hi,
I'm trying the same.
Do you have any updates after the last message you send?
Can't we decode the activation code instead?
Click to expand...
Click to collapse
No updates yet as I've been busy with other things. Being able to generate activation codes could be a possibility and if anyone is able to get an SPI dump that would also help out a little.
willmav5000 said:
Hi everyone,
I'm looking for a little help modifying the ToyotaHMIMainSWUpdate.swf to skip the activation check when updating the maps.
Click to expand...
Click to collapse
Hi! For what I've seen Toyota Touch & Go 2 seems to be sharing the QNX platform with Jeep (FCA) Uconnect. So this sounds very similar here where the 1st check happens "within the update image" itself as quick and simple validation for file/version origin and match to the head unit hardware. But then the second and slow image hash validation is done before flashing the data "on the head unit" - and inevitably fails... Unless you get full access to the head unit
willmav5000 said:
Making modifications to the swdl and swdlInstall ISOs isn't an issue as I'm able to rebuild them with a valid signature.
Click to expand...
Click to collapse
So yes, I believe you can fool the quick signature check, but no go with the full image sha256 hash verification. On the Uconnect the way to go is to exploit the head unit to gain root access and then to avoid the verification, but still modified Nav binary may be needed to skip map license check...
devmihkel said:
Hi! For what I've seen Toyota Touch & Go 2 seems to be sharing the QNX platform with Jeep (FCA) Uconnect. So this sounds very similar here where the 1st check happens "within the update image" itself as quick and simple validation for file/version origin and match to the head unit hardware. But then the second and slow image hash validation is done before flashing the data "on the head unit" - and inevitably fails... Unless you get full access to the head unit
So yes, I believe you can fool the quick signature check, but no go with the full image sha256 hash verification. On the Uconnect the way to go is to exploit the head unit to gain root access and then to avoid the verification, but still modified Nav binary may be needed to skip map license check...
Click to expand...
Click to collapse
Yeah the initial component in green is verified by one of the public keys, while the second part in blue is just a sha256 digest based on the remainder of ISO file. I am able to replicate both of those with some custom scripts I've written and fully alter the ISO how ever I want, I can still successfully pass the first stage of validation and initiate the update and/or execute custom scripts until the device restarts for the actual installation process. I still haven't been able to figure out how the third part in red is generated, but I do know that it also utilizes the sha256 digest in some way.
I have a dump of all the files from the head unit and have decoded all the Lua files. I've been looking over everything and discovered a few things of interest, but nothing solid yet.
Right, still sounds similar to the Jeep exploit, that by modifying the update image you can execute random code as root(?) on the head unit while triggering the update check? Could you then just copy and replace the updated map files into the storage?
willmav5000 said:
No updates yet as I've been busy with other things. Being able to generate activation codes could be a possibility and if anyone is able to get an SPI dump that would also help out a little.
Click to expand...
Click to collapse
Hi,
could it be helpful, if I send you original activation codes?
I have Toyota Touch 2 With Go (Toyota Auris 2018) software version 6.20.0SPWL (map version 2022 v2)
From 2019 until 2022 I have updated my system via MapCare, so I have 7 original activation codes for my device (and for 7 updates numbered from 6.13.0L to 6.19.0L)...
Together with my device ID you can perhaps figure out how activation codes are generated...
I could also help by sending you my activations codes and my device ID.
I have a 2017 Rav4
something new?
Nothing new, I've been unable to obtain any dumps and I've been away so this has been shelved for now.
Dear @willmav5000
You certainly hear about GreeLuigi1 and his hack of Hyundai system (https://programmingwithstyle.com/)
He successfully entered in the system and explain all the steps to do it.
He also published on GitHub the procedure to decrypt Hyundai firmware: https://github.com/greenluigi1/HyundaiFirmwareDecrypter
Could you please explain how you proceed to try to hack Toyota system?
You obtain SWF file I think for the Toyota update package (KWI file maybe?) but how?
If we cross our knowledge we should be able to progress further, I hope.
Regards

Categories

Resources