FINALLY! CUSTOM APK INSTALLS (NA MODEL)

[derbo904]

No idea, although codeage is at a much lower build. Also he also said that the script failed a few times for him. Maybe just keep trying til it works?

I give up for now. It keeps boot looping with or without the script when trying to mount the system as read/write. I'm guessing I have one of the newest builds out?

Sponsored

 

[derbo904]

I got su from oneclick zip file for pilot and chmod 6777 /system/xbin/su

How did you mount the system as rw without a bootloop?

 

[codeage]

Update on my trials:

Car:
2017 Hatchback EX
Headunit Version:
Build Number 1.F191.02

Hardware:
2015 rMBP 15" with Homebrew ADB/NDK installed

• Turn on Dev Mode on the Headunit
• Set it to Device Mode
• Plugged in my Macbook, ran ADB Devices to see it listed.
• I successfully ran dirtycow's exploit "make root" in the exploit folder and was able to get root access.
• Ran ADB Shell and run-as to get privileged shell.
• Moved /data/data/whitelist-1.0.xml to /usr/local/tmp/
• chown the file to shell:shell
• I pulled the XML and edited the whitelist with the appropiate waze/spotify/keystores and pushed it back to the headunit /usr/local/tmp
• cp /usr/local/tmp/whitelist-1.0.xml to /data/data
• exit the shell, ran adb reboot
• Headunit reboots
• I plugged in my 8GB MBR FAT32 USB stick in the USB port under cupholders (USBDRIVE2) with Waze 4.25.02 APK in root folder.
• APK installer file list DOES NOT see the apk.
• I threw a wallpaper on the USB and the gallery does see it.

Any ideas @Deep, @codeage ? I'm getting a "Connected Device is not Responding"

IT-DNG-rMBP:CVE-2016-5195-master dng$ make root
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-17
make[1]: Entering directory `/Users/dng/Downloads/Civic ADB/CVE-2016-5195-master'
[armeabi-v7a] Compile thumb  : dirtycow <= dirtycow.c
[armeabi-v7a] Compile thumb  : dirtycow <= dcow.c
[armeabi-v7a] Executable     : dirtycow
[armeabi-v7a] Install        : dirtycow => libs/armeabi-v7a/dirtycow
[armeabi-v7a] Compile thumb  : run-as <= dirtycow.c
[armeabi-v7a] Compile thumb  : run-as <= run-as.c
[armeabi-v7a] Executable     : run-as
[armeabi-v7a] Install        : run-as => libs/armeabi-v7a/run-as
make[1]: Leaving directory `/Users/dng/Downloads/Civic ADB/CVE-2016-5195-master'
adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow
libs/armeabi-v7a/dirtycow: 1 file pushed. 0.9 MB/s (17880 bytes in 0.019s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as
libs/armeabi-v7a/run-as: 1 file pushed. 0.8 MB/s (5544 bytes in 0.007s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (5544) and destination file size (9464) differ

[*] size 9464
[*] mmap 0x401f2000
[*] currently 0x401f2000=464c457f
[*] using ptrace method
[*] madvise = 0x401f2000 9464
[*] ptrace 0 4
[*] exploited 7052 0x401f2000=464c457f
IT-DNG-rMBP:CVE-2016-5195-master dng$
^[015c026ed634160a    device

IT-DNG-rMBP:CVE-2016-5195-master dng$ adb shell
shell@android:/ $ run-as
uid run-as 2000
uid 0
no selinux?
shell@android:/ #

Edit:

I'm going to double check my XML settings again and try a few versions of Waze and different USB sticks.


Edit (4:06pm PDT)

No luck. I tried 2 different USB sticks with different versions of Waze from different sources. The Headunit can definitely see it, but the APK installer doesn't.

IT-DNG-rMBP:~ dng$ adb shell
shell@android:/ $ run-as
uid run-as 2000
uid 0
no selinux?
shell@android:/ # cd /usbdrive2 && ls -l
d---rwxr-x system   media_rw          2017-06-24 16:02 PK
d---rwxr-x system   media_rw          2017-06-24 14:53 System Volume Information
----rwxr-x system   media_rw 27059534 2017-06-24 15:44 com.spotify.music_5.9.0.774-13633811_minAPI15(armeabi-v7a)(nodpi)_apkmirror.com.apk
----rwxr-x system   media_rw 54188909 2017-06-24 14:52 com.waze.apk
----rwxr-x system   media_rw 40670040 2017-06-24 14:28 com.waze_3.9.8.0.apk
----rwxr-x system   media_rw 47040297 2017-06-24 14:27 com.waze_4.1.0.1.apk
----rwxr-x system   media_rw 54188909 2017-06-24 14:26 com.waze_4.25.0.2.apk
shell@android:/usbdrive2 #

Edit: 4:46pm PDT

Maybe I forgot to put the device back into Host mode? Would a reboot reset this?

Edit:
Nope, it resets to host when the car is turned off.


OT EDIT:
I pulled the bootanimation out. We could probably customize the boot animation as well.

System/media/bootanimation.zip

Personally I dit not use a sdcard to install apps. Before I rooted the device, I used this method to install apps:

1. modify /data/data/whitelist-1.0.xml
2. adb push file.apk to /data/local/tmp
3. open adb shell
4. execute: run-as
5. execute: /data/local/tmp/rootme/su
6. execute: pm install /data/local/tmp/file.apk

 

[mikealanni]

How did you mount the system as rw without a bootloop?

Just login , run-as then run mount command

 

[mikealanni]

I think it reboot as might some apps trying to run.... So maybe if you put the head unit in FM then try the command and also if you use the bypass video method then might you need to uninstall the whitelist service and reboot then try the mount command again... Or might try go to the safe mode (holding menu while reboot) then try mount command again

 

[derbo904]

Just login , run-as then run mount command

That boot-loop me.

 

[mikealanni]

I installed newpipe light youtube ( no need to Google play service) and works very smooth. Now trying to find MirrorLink or any apk let us mirror our phones

 

[wyocivicguy]

So mostly followed the instructions put together by @Deep - and Waze is working beautifully.

I used your paste of your whitelist for waze and spotify - spotify seems to be the one trickster here. I've installed a 5.9 and a lesser 5.8 version of the apks and they stay black. Did you encounter anything like that?

 

[Deep]

So mostly followed the instructions put together by @Deep - and Waze is working beautifully.

I used your paste of your whitelist for waze and spotify - spotify seems to be the one trickster here. I've installed a 5.9 and a lesser 5.8 version of the apks and they stay black. Did you encounter anything like that?

Right now I'm using 5.5 and it's working perfectly.

 

[wyocivicguy]

Right now I'm using 5.5 and it's working perfectly.

Winner winner, chicken dinner. Installed and works great!

 

[db91]

Winner winner, chicken dinner. Installed and works great!

How do you uninstall an existing app?

I'm in the same boat as you, v5.8 just gives me a black screen.

 

[derbo904]

How do you uninstall an existing app?

I'm in the same boat as you, v5.8 just gives me a black screen.

System > Detailed information > Apps > Downloaded > Click Spotify > uninstall

 

[mikealanni]

System > Detailed information > Apps > Downloaded > Click Spotify > uninstall

Also don't forget each time you uninstall app to update the whitelist to keep it clean

 

[db91]

Also don't forget each time you uninstall app to update the whitelist to keep it clean

You mean, if I completely remove it rather than instead a different version, right?

 

[dc2turbo]

My car battery was dead after messing with this for 45min.. had to jump the car. I thought I bricked my headunit. Bunch of errors popped up and car wouldn't start after the headunit shut off out of no where

Sponsored