Ford Navigation Fault Hacks

Back in January of this year we had a family getaway to a remote place in Batangas where cellular signal was really poor, I’ve lost signal and suddenly Waze started acting up and pointing me to a wrong direction, so I fired up the Ford built-in Navigation but to my surprise it prompted me with “Navigation Fault”.

 

After the January holidays I quickly called up Ford Libis about the error and took the car to the dealership where it stayed their for two days until my Service Advisor called up that I can pick-up the car as it’s not a serious damage and my safety will not be compromised, to my surprise they don’t know how to fix the problem and that they are waiting an update from Ford Thailand, I’m wondering why it took them sooo long to get an update, does Ford have emails? Or they’re still using snail mail. After three long months of back and forth calling them about the issue if they have updates and they can fix it already still I got disappointed, I email Ford Philippines same old marketing reply “we are working on the issue, we will send you an update, blah blah blah. There’s a new update file Sync3 v3.0 on the Ford owner website, my hopes are up that this could fix my Navigation Fault problem, but then again it failed me.

I’m an Infosec guy by profession and yes I love breaking things apart and put them back again, so I did my own research and spent the whole night without sleep and just surviving with coffee just to figure out how the Ford installer works.

Theory #1:

It could be that the one installed on my car Sync3 v2.3 was already broken and was missing something so upgrading would not fix the Navigation Fault.

I dig through the Sync3 v3.0 update files which have some really weird file names GB5T-14G386-AA, JL7T-14G391-FB, etc…etc…I extracted each and one of them and found out that they are only shell scripts extracting images, digging through all of the files I didn’t see any updates on the “Navigation Application” nor updates on the map images, so my theory was correct there are still missing files on my system.

Research #1:

APIM is the control module which communicates from Sync3 system to the GPS antenna, and IVSU are the softwares sending communications to the APIM module. I took note of the IVSU versions on the Sync3 v2.3 then I fuzz this URL using Burpsuite to get those files

http://ivsu.binaries.ford.com/swparts/*

(Note: to get to the APIM diagnostics, just long press Eject and Forward button)

 

Here comes problem #1

Problem #1:

How on earth can I instruct Sync3 system to load those files, I extracted them and analyzed each shell scripts what they were doing to the system and assembled my own autoinstall.list

Here’s the autoinstall.list explaination.

 

 

When you extract HB5T-14G386-TCB I see that this is a utility that will clean up the Sync file system, thus it should go first on the autoinstall.lst, the first line [SYNCGen3.0_2.3.17020_PRODUCT] tells the installer that we are installing this version.

After cleaning up the Sync filesystem time to push the 2.3 files.

[SYNCGen3.0_ALL] tells the installer to call and install all files specified.

JL***-AE — this is the MAIN Sync 3 Application OS so it should be on top of Sync3 installer

JL***-FB — this is the VOICE of Sync 3, maybe that lady that speaks in your Sync 3 system 🙂

JL***- FA — this is the GRACENOTE of Sync3, search Gracenote so you know what it means.

Lastly

GB5T-14G386-AA — the interrogator file, wrapping up the install.

 

Now bring the constructed Sync3 v2.3 USB to the car and perform just a regular update. Turn off the car, lock the car for 5 minutes, open and start it up.

There’s my Sync3 v2.3 with Navigation back to life.

 

Then I proceed with upgrading my currently working Sync3 v2.3 to Sync3 3.0 with Waze support

Comments