Jump to content

Welcome To Cameraloops

Take a moment to join and become a member

Hacking the GM HMI 2.5 module.


 Share

Recommended Posts

Hacking the GM HMI 2.5 module.

I'm on a quest for hacking the GM HMI 2.5 module to figure out and understand more about its functionality.

This article is a place holder for future findings and experiments.

 

To be continued 

 

IMG_5021 (3).jpeg


Troy

About The Author

Troy is a professional Artist, Photographer, Videographer, Musician and Creator with a love for arts, electronics, coding, hacking stuff, traveling, taking photos and creating internet content. He is also the founder of CameraLoops.com



View full

Link to comment
Share on other sites

  • 2 weeks later...
  • 2 weeks later...
  • 3 weeks later...

Connect to the pins shown to see the Linux console.  You do not need to have the whole system (radio, BCM, etc) hooked up to do this.  You only need power, GND, and communication enable signal on connector X1.   You will see system boot events on console, and then it will go to sleep.  If you have the whole system hooked up, you will see full boot, but will not get a login prompt. 

 

To force system into UBoot, tap reset (pin 2) to GND four times, about one second apart.   After system fails to boot four times, it will drop into UBoot for recovery. 

 

The system has a good firewall, but we can walk right around it with the serial console. From UBoot you enable normal mode serial login.  Once in normal mode serial console,  you can enable SSH login over ethernet using scripts and drivers Bosch included with the system.  There are even tools for changing individual calibration values.  No SPS or DPS needed.

HMI25_serial.png

  • Like 4
  • I Vote Up 2
  • Thanks 1
Link to comment
Share on other sites

  • 2 weeks later...
On 8/26/2021 at 4:54 AM, HMI_Guy said:

Connect to the pins shown to see the Linux console.  You do not need to have the whole system (radio, BCM, etc) hooked up to do this.  You only need power, GND, and communication enable signal on connector X1.   You will see system boot events on console, and then it will go to sleep.  If you have the whole system hooked up, you will see full boot, but will not get a login prompt. 

 

To force system into UBoot, tap reset (pin 2) to GND four times, about one second apart.   After system fails to boot four times, it will drop into UBoot for recovery. 

 

The system has a good firewall, but we can walk right around it with the serial console. From UBoot you enable normal mode serial login.  Once in normal mode serial console,  you can enable SSH login over ethernet using scripts and drivers Bosch included with the system.  There are even tools for changing individual calibration values.  No SPS or DPS needed.

HMI25_serial.png

Great info. Thanks 

Link to comment
Share on other sites

On 26.08.2021 at 08:54, HMI_Guy said:

Подключитесь к показанным контактам, чтобы увидеть консоль Linux. Для этого не обязательно подключать всю систему (радио, BCM и т. Д.). Вам нужно только питание, заземление и сигнал разрешения связи на разъеме X1. Вы увидите события загрузки системы на консоли, а затем она перейдет в спящий режим. Если у вас подключена вся система, вы увидите полную загрузку, но не получите приглашения для входа в систему. 

 

Чтобы принудительно запустить систему в UBoot, нажмите сброс (контакт 2) на GND четыре раза с интервалом примерно в одну секунду. После того, как система не загрузится четыре раза, она перейдет в UBoot для восстановления. 

 

В системе есть хороший межсетевой экран, но мы можем обойти его с помощью последовательной консоли. Из UBoot вы включаете последовательный вход в нормальном режиме. Находясь в обычном режиме последовательной консоли, вы можете включить SSH-вход через Ethernet, используя скрипты и драйверы Bosch, включенные в систему. Есть даже инструменты для изменения индивидуальных значений калибровки. Никаких SPS или DPS не требуется.

HMI25_serial.png

Hello there.
My question is, where should I connect the pins in the picture to the monitor or computer?

Link to comment
Share on other sites

On 19.07.2021 at 14:55, Troy said:

Я хочу активировать видео в движении, включить камеру заднего вида, выключить onstar и так далее. У вас есть какие-нибудь знания об этом?

you can activate the video in motion by calibrating it, as well as the rear camera

Link to comment
Share on other sites

On 19.07.2021 at 14:55, Troy said:

Я хочу активировать видео в движении, включить камеру заднего вида, выключить onstar и так далее. У вас есть какие-нибудь знания об этом?

IMG_5153.MOV IMG_5153.MOV
Link to comment
Share on other sites

  • 2 weeks later...
  • Contributors

@Troy notice how you attack people in different forums about not giving free helps or anything, but in the same time people here are begging for the EMMC read pinouts and you are not giving it
i like the work and effort you provide but sometimes you are vague

Link to comment
Share on other sites

1 minute ago, PLSA said:

@Troy notice how you attack people in different forums about not giving free helps or anything, but in the same time people here are begging for the EMMC read pinouts and you are not giving it
i like the work and effort you provide but sometimes you are vague

Well if you read on the other forums you will see no one really gave me any free information.

The majority of the information I publish are info I figure out on my own.

Everyone on that forum were selfish towards me except 2 people.

Why should I be kind and offer everything free to this world full of selfish people.

"Vague", call it what you will, I'm only reflecting back what was reflected at me.=Peolple were selfish to me so I too be selfish back to people.

EMMC pin outs can be figured out using a logic analyser.

Regards 

 

 

 

Link to comment
Share on other sites

  • Contributors
Just now, Troy said:

Well if you read on the other forums you will see no one really gave me any free information.

The majority of the information I publish are info I figure out on my own.

Everyone on that forum were selfish towards me except 2 people.

Why should I be kind and offer everything free to this world full of selfish people.

"Vague", call it what you will, I'm only reflecting back what was reflected at me.=Peolple were selfish to me so I too be selfish back to people.

EMMC pin outs can be figured out using a logic analyser.

Regards 

 

 

 

ok, so i wish you don't start calling people out for their actions while you are as you stated (copying their actions)
anyway i am also against their way of selfishness, and about the pinouts i really need those cause i tried to get them but no hope, i am not an electrician

Link to comment
Share on other sites

3 minutes ago, PLSA said:

ok, so i wish you don't start calling people out for their actions while you are as you stated (copying their actions)
anyway i am also against their way of selfishness, and about the pinouts i really need those cause i tried to get them but no hope, i am not an electrician

No I'm not copying their, or anyone's actions. Look I've publish many tutorials on this site with loads of free information that is no where else on the web.

I've shared a lot of free files.

I've helped a lot of folks in PM-land with lots of information.

Selfish people share nothing 😀

 

For the pinouts unfortunately I won't be sharing those, not yet.

Maybe when I figure out some more things about the HMI.

For now the Pin outs are only useful for dumping and flashing the EMMC.

 

 

 

 

 

 

Link to comment
Share on other sites

  • Contributors
2 minutes ago, Troy said:

No I'm not copying their, or anyone's actions. Look I've publish many tutorials on this site with loads of free information that is no where else on the web.

I've shared a lot of free files.

I've helped a lot of folks in PM-land with lots of information.

Selfish people share nothing 😀

 

For the pinouts unfortunately I won't be sharing those, not yet.

Maybe when I figure out some more things about the HMI.

For now the Pin outs are only useful for dumping and flashing the EMMC.

 

 

 

 

 

 

i am also working on that, but dumping and flashing the emmc could help copying maps (for me at least)

Link to comment
Share on other sites

5 minutes ago, PLSA said:

i am also working on that, but dumping and flashing the emmc could help copying maps (for me at least)

Yep, that could work, however, after you dump the EMMC you will have an issue with mounting and extracting the EMMC image for files inspection. 

The EMMC image is coded with a none standard priority disc partition format.

I think attacking the EMMC via jailbreaking would be the best route.

Link to comment
Share on other sites

  • Contributors
On 7/19/2021 at 11:55 AM, Troy said:

I want to active video in motion, reverse camera on, turn off onstar and so forth. Do you have any knowledge for it?

I have an HMI 2.5 EMMC image with reverse camera turned on, I actually want to turn it off, so maybe we can help each other out.

Link to comment
Share on other sites

  • Contributors
On 9/25/2021 at 8:39 PM, Troy said:

Yep, that could work, however, after you dump the EMMC you will have an issue with mounting and extracting the EMMC image for files inspection. 

The EMMC image is coded with a none standard priority disc partition format.

I think attacking the EMMC via jailbreaking would be the best route.

 

The EMMC uses MBR and has a total of 6 partitions. 3 primary partitions and 1 extended partition with 3 partitions, all  formatted in EXT4.

Content Partition 1.jpg

Content Partition 2.jpg

Content Partition 3.jpg

Content Partition 4.jpg

Content Partition 5.jpg

Content Partition 6.jpg

Partition 1.jpg

Partition 2.jpg

  • Thanks 1
Link to comment
Share on other sites

13 hours ago, Miragui said:

 

The EMMC uses MBR and has a total of 6 partitions. 3 primary partitions and 1 extended partition with 3 partitions, all  formatted in EXT4.

Content Partition 1.jpg

Content Partition 2.jpg

Content Partition 3.jpg

Content Partition 4.jpg

Content Partition 5.jpg

Content Partition 6.jpg

Partition 1.jpg

Partition 2.jpg

I'm able to dump the EMMC but not able to mount it.

Can you share how you mount the image for file inspection?

Which OS and which software are you using to mount the EMMC image?

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...

Important Information