navdy 해킹 성공? 펌웨어 최신버전 설치하기

레딧에 드디어 용자가 나타났다. coronafire 이란 유저가 해킹에 성공했다. (비록 펌웨어 전송이지만). 안드로이드용만 해당되는 내용.

coronafire님의 활동 한 눈에 보기

Welcome to Reddit. Come for the cats, stay for the empathy. Become a Redditor and start exploring. × 정렬: 최신 [HOWTO] Update your display firmware (and hack it) by coronafire in navdy [–] coronafire [ S ] 1 점 1 일 전에 There's been plenty of people without working traffic on older firmwar

www.reddit.com

참고로 아래 작업에 대한 결과는 보장 못하며 고장나도 본인은 책임 지지 않는다. 

본 작업은 내브디 해킹이 아닌 초기 공장모드로 돌아간 유저와 내브디가 망하기 전에 최신 버전으로 업데이트 하지 못한 사용자들을 위한 작업이다. 

즉 내브디가 망하기 전에 어플로 펌웨어를 다운받고 기계로 전송해주는 작업을 PC로 해주는 작업이다. 


coronafire 에 의하면 내브디의 부트로더는 굉장히 심플하고 다루기 쉽다고 했다. 곧 해킹 이미지 펌웨어가 나올듯 싶다. 
예상으론 유저들이 가장 많이 요구했던 waze 어플 이식과 미러링 기능이 추가 되지 않을까 싶다. 사실 waze만 이식되어도 컴바이너 내비게이션계에서는 최강자이지 않을까. 지금도 최고고. 

내브디 안팔길 잘했어...ㅠㅠ 

Exciting times people! Everyone say thanks to @wanderabyss who managed to find and download the final navdy update image from AWS before they were shut down.
This has been unpacked and tested ready to flash onto your display from PC. While it took a few days of examining and testing before I was willing to gamble my navdy in test flashing, it's actually very simple and safe to achieve.
You will need a computer with google/android fastboot installed. If you don't have this already, there are lots of guides: http://www.teamandroid.com/2016/06/15/install-fastboot-adb-google-usb-drivers-windows/https://wiki.lineageos.org/adb_fastboot_guide.html
Then take your navdy (not plugged into car), hold down the power button and plug it into computer with the micro usb cable in the back. The navdy power light should come on red. On windows you may need to manually assign the Android Bootloader driver to it in device manager, the first link above should help with that.
Grab one of the update packs from https://androidfilehost.com/?w=files&flid=267727 and unzip it. navdy_firmware_3049.zip is the last official beta release, unmodified. All zips newer than this will be discussed below.
If you're on windows and fastboot is installed in the path, there's a batch file in the zip you should be able to just run. On other platforms, the command in the batch file should just work in any terminal you can copy/paste. This is also assuming fastboot in on the path. If not, run each command with full path.
Once it's done, as long as no errors were reported on the terminal, your navdy should restart and come up on the computer as a flash drive like when plugging it in without holding power button. Now you can unplug it and use it in your car!

Downloads for : -Android- Generic Device/Other | AndroidFileHost.com | Download GApps, PA GApps, Roms, Kernels, Themes, Firmware and more. Free file hosting for all Android developers

Download GApps, PA GApps, Roms, Kernels, Themes, Firmware, PokeMesh and more. Free file hosting for all Android developers.

androidfilehost.com

Ok, now the fun begins.
The update packs starting from 3050 have been modified, unlocked, rooted and busybox'ed!!!
When navdy is plugged into 12V (aka mounted in car or has 12V injected into it's car cable on the correct pins) and is running normally, plugging in the USB to computer brings it up with the standard ADB remote login interface.
Root took quite a few goes to achieve, but should be easy to expand upon.
Inside the original update pack the boot.img and system.img are standard android images that can be unpacked and repacked with common tools. Thankfully the bootloader in the navdy is pretty simple and doesn't enforce any original signatures.
fyi don't try to run fastboot boot boot.img. This is a common way to boot a modified image without flashing it first. However it doesn't work on the navdy. If you've got 12V connected it just boots the flashed image anyway. If you don't have 12V (aka just the usb cable) it boots into a dead state with the power led flashing red. This state has no USB and the power button does nothing. Unplugging the usb does nothing, it's stuck. You cannot get out of this state without either opening up the navdy and unplugging it's battery, or I presuming waiting for it's battery to go flat (which could take some time)
Back to adb; unfortunately this didn't have working root enabled as it's a production build.
Even modifying the boot.img to allow adb root command to run didn't work, the shell never actually escalated.
Tried using magisk manager on my phone to install magisk into the boot.img. Didn't boot, just went into a recovery bootloop.
Tried porting TWRP to navdy. Didn't get very far. I've got a recovery image that kind of starts up (from an adb reboot recovery) command. The screen starts up but never actually displays anything, and the USB doesn't ever connect. But at least it shuts down by itself when unplugged.
I tried manually installing supersu into the boot.img and into the system.img (by following the install script by hand and placing things in the right place). Got it to install and run, could connect on adb, had su (root worked!) but the navdy app never actually ran, it was stuck in a startup screen bootloop.
Followed a similar path with phh superuser and eventually got a working root!
This is a systemless root and provides scripts to modify the boot.img on pc to install root. This didn't completely work, had a broken boot.img, but I migrated it's changes to a boot.img unpacked/repacked with either Android Image Kitchen or superrs-kitchen and got it going. Then had to modify the boot startup scripts to place files in the right locations to allow phh superuser to work without needing it's companion apk installed (adb install failed, wouldn't verify). Took a few trials with different settings to get su to fully work but now it's looking great, we've got full root access over ADB.
I also unpacked system.img and installed busybox manually, it's useful for lots of scripts. At this point I packed it all up and that's the "navdy_firmware_3050_odex.zip" on the download link above.
I've also run system.img through the deodex command in superrs-kitchen and repackaged into "navdy_firmware_3050.zip" This is the one I suggest if you want to do any hacking on navdy. It appears to boot fine, but I don't know if the deodexing has caused underlying issues anywhere. Note: the first boot will take a few minutes, if you're keen you can connect adb while it's booting and watch the startup odexing with logcat.

요약하자면 http://www.teamandroid.com/2016/06/15/install-fastboot-adb-google-usb-drivers-windows/

How to Install Fastboot, ADB and Google USB Drivers on Windows - Tutorial / Guide

This tutorial is how to install Fastboot, ADB and the official Google USB drivers on a Windows without downloading Android SDK Tools.

www.teamandroid.com

먼저 google / android fastboot가 설치된 컴퓨터가 필요하다. 
여기로 가서 platform-tools-latest-windows 대부분 윈도우 사용자일테니 나같은 경우는 윈도우 버전을 받았다.
그리고 실행창을 관리자 모드로 실행후 아래 platform-tools-latest-windows이 다운된 경로로 이동후 adb devices 명령어만 실행 시켜주면 된다. 
아래 화면처럼 간단하게 실행된다.

그런 후 아래 링크에서 원하는 펌웨를 다운받고 압축을 풀어 놓는다. 3049가 오피셜 최신 버전이고 3050은 앞으로 해킹을 하려면 이 버전을 설치해야 되는갑다. 사용자가 내브디 기계에 대한 루트 권한을 얻게금 수정한 이미지 압축파일이다. 

본인은 아래 링크가 언제 끊길지 몰라 업데이트된 모든 펌웨어를 다운받아 놨다. 
https://androidfilehost.com/?w=files&flid=267727 

Downloads for : -Android- Generic Device/Other | AndroidFileHost.com | Download GApps, PA GApps, Roms, Kernels, Themes, Firmware and more. Free file hosting for all Android developers

Download GApps, PA GApps, Roms, Kernels, Themes, Firmware, PokeMesh and more. Free file hosting for all Android developers.

androidfilehost.com

내브디 본체를 차량에서 분리해 가져와 전원 버튼을 누른 상태에서 내브디와 PC를 연결하고 펌웨어가 다운된 경로에서 FLASH_3050_ROOT.bat 배치파일을 실행시키면 펌웨어가 내브디로 설치된후 재부팅 된다. 
 
별 문제가 없다면 최신 버전의 펌웨어가 내브디로 설치된 후 재부팅 될 것이다. 본인의 내브디는 최신 버전까지 업데이트를 해서 위의 작업을 할 필요가 없어 테스트는 해보지 않았다. 


결국 아래 댓글 처럼 내브디에 팽당한 내브디 유저들이 마음대로 어플을 수정하고 개발 할 수 있는 날이 왔으면 좋겠다. 
In my mind, the next step would be to identify the Navdy application installed on the device, decompile it, and go from there. We can make iterative changes to that app and sideload updates to the device. We could even replace the S3 bucket specified in the Android app with our own to allow OTA updates.