[AlphaWIP]

Introduction - The Story
Longtime Ghibli owners know how bad the Bluetooth functionality of our UnConnect / Maserati Terrible Connection (MTC) is. On some days it would work normally, other days it would refuse to connect to any device. Repeated dealer visits and replacing the HFM module yielded zero success. My dealer flashed the HFM module firmware to the latest version, which gave me song metadata but still didn't solve the issue.

The dealer then told me there were no further firmware updates and that I just had to accept the BT functionality being unreliable. Inputting my Ghibli's VIN on UConnect's update website lead to an error saying the VIN was invalid, which makes sense since Maserati rebranded it to MTC. Even though I have already installed a wireless CarPlay unit, I still wanted BT to work since this specific music app I'm using has an official DTS surround sound plugin which sounds terrible over CarPlay and USB but would sound phenomenal over BT. Yes, I eventually took the risk of bricking my radio over trying to slightly improve audio playback quality.

I wanted to know if there are any updates at all for our UConnect. I knew that our radio, the RB5, is also used in Dodge Charger, Chrysler 300/300C, and some Fiats. I also knew from installing my own navigation maps that it is feasible to flash the navigation firmware from a Dodge Charger into a Ghibli to downgrade it to CTP13 so we can flash the new maps ourselves. I also knew that my UConnect has a software version of 15/09/D1 from the dealer menu. With all that, I Google'd "UConnect 15/09/D1" and lo and behold, there was actually a new update issued in early 2017 with the version 16/21/D7!

The patch notes:

TSB 08-004-17 refers to a software update for your Uconnect system:

"NUMBER: 08-004-17
GROUP: Electrical
DATE: January 12, 2017

SUBJECT:
Flash: RE2 RE3 RE4 RE6 RE7 RB4 RB5 RB6 Radio Enhancements

SYMPTOM/CONDITION:
A customer may experience one or more of the following conditions:
• ** Navigation screen locks up or display will be blank (Software has been updated to better address this condition).
• Intermittently the radio display screen may be black or the radio will reset.**
• Navigation feature lockout disabled (International Only) (Software has been updated to better address this condition).
• Improve FM radio reception (This only applies to 2013 or 2014 LX vehicles with RE6, RB6 radios located in Dubai).
• Radio display screen shows “Test Mode”.
• Navigation system may reset intermittently.
• Translation improvements/corrections.
• System consistency and operational improvements for menu selections, month/date formatting, and Garmin translation functions.
• Radio system improvements during remote start operation.
• Unable to adjust radio volume using steering wheel switch intermittently.
• Second screen is blank when using split screen function.
• Some functionality for Japanese and Korean languages- keyboard, search, sort and jump.
• Unable to add contacts to the favorite list.
• Unable to dial the phone from the radio, while still able to dial from the phone.
• Unable to delete a cell phone number from the favorite list.
• More space available for phone book entries.
• BlackBerry support for playing songs.
• Reduce ticking noise during CD/USB pause and Voice Recognition (VR) is silent between prompts.
• VR unable to transition from non-navigation to navigation mode.
• iPod screen is displayed with navigation screen.
• Asian language translation added.
• Highlighted preset continues blinking.
• Takes more than one button press to select preset #10 .
• Unable to adjust volume from steering wheel switches.
• Clock adjust pop up message displayed in English rather than current language.
• Can not connect to the phone after it has been disconnected.
• Teleprompter screen shows incomplete text.
• Some functionality for traffic & weather jump button.
• After changing a language and then selecting CDDA, “of” is displayed as a tracking number.
• In “Set Date Year” only 3 digits are displayed.
• Split map view will not cancel.
• Map screen turns black when driving.
• When in Italian, the destination arrival text will overlap onto the map.
• Does not accept Iraq when commanding “Set Target Country”.
• Some pop up message characters are displayed with “!#”.
• Traffic programming slow to start."

The line I highlighted caught my interest. Could this be the long-awaited BT fix? I decided to get my hands on a firmware update for Dodge Charger and risk it. Since we could downgrade our Garmin with their firmware, then surely we can upgrade our UConnect with their firmware too...

Why we didn't get this update? My guess is Maserati had already moved on to MTC+ by then (MY2017) and did not want to spend time on fixing older radios.

--------------------------------------------

Obtaining the New Firmware Image
How can we download the new firmware if the official website doesn't take our VIN? I went on CarGurus to look for a Dodge Charger for sale with the same RB5 nav as we do. Here is the VIN I used: 2C3CDXHG0EH321930.

Go to UConnect's update website and paste in the VIN: Software Update for Uconnect® - Check For Updates

Then, just follow the instructions presented to you. I wouldn't do the navigation update to CTP17 since some people imply it might disable downgrading to CTP13 to flash maps without a dealer visit.

A caveat though: I had to format my USB drive to FAT with Master Boot Record under macOS. For whatever reason, UConnect could not read my drive when I formatted it under Windows.

The update should take no more than 20 minutes. I recorded the process and here are my initial reactions:

SW version before the update:

The update prompt when the USB drive was inserted:

During the flash:

After the firmware update:

Observations
Removing paired devices is much faster and the pairing process is also a lot faster. I will need to give it a few days to see if the BT issues have truly been fixed. You are all welcome to install this update and see if the BT situation has improved!

Thanks for reading!

 

[Joe-Ghibli]

Following. Nice work. Hoping this is a solution for MTC (2014-2016) owners. Question, how does one install wireless CarPlay on a 2014-2016? Just curious. I am using a Carlinkit Dongle, but this is for cars that have wired CP already.

 

[CnoteMD]

Excellent work! My car has an even older firmware version than yours (13/50/99). If I follow your instructions will it upgrade to the most current version, or do I need to a “pre-update” first?

I look forward to hearing how your system is working in the upcoming days.

 

[dkarpouzos]

Nice Work! I just performed the update from 15/29/D7 to 16/21/D7. Phone was able to connect both times I started car so far. Fingers crossed that this fixes the problem. Once again, thanks to AlphaWip for taking the time to try and figure this out.

 

[AlphaWIP]

Following. Nice work. Hoping this is a solution for MTC (2014-2016) owners. Question, how does one install wireless CarPlay on a 2014-2016? Just curious. I am using a Carlinkit Dongle, but this is for cars that have wired CP already.

You would need to disassemble the dashboard and stuff a CarPlay box behind the screen.

 

[AlphaWIP]

Excellent work! My car has an even older firmware version than yours (13/50/99). If I follow your instructions will it upgrade to the most current version, or do I need to a “pre-update” first?

I look forward to hearing how your system is working in the upcoming days.

I’ve seen people asking similar questions on Dodge forums but didn’t really pay attention to any answers. I’m not too sure if you need to update it to 15 first.

 

[CnoteMD]

I performed the update and everything initially worked well. My firmware was updated from 13/50/99 to 16/21/D7 without any glitches. After the initial restart, everything look great and I even saw a screen explaining how the VR button on the steering wheel can be used for Siri commands (this was a first).

I had a few errands to run, so after making my next stop, I shut the car down as usual. But when I came back to the car, Bluetooth would no longer connect.

I tried everything. I even deleted the profile from the car and my phone and tried to reconnect. Nothing! Again, I got the issue where the car stops sending a bluetooth signal. So I couldn't even set my phone up as a recognized device until it decided to start functioning again. Ultimately it allowed me to re-establish the Bluetooth connection after about 3 more trips (with full shut down and start up).

It looks like things are just as bad as before for me. It’s promising to see that others are having success. It looks like I will need to go back to the dealership and see if there is a true hardware problem somewhere else. Within the last week, I have had the handsfree module replaced and updated my firmware without resolution.

 

[AlphaWIP]

I performed the update and everything initially worked well. My firmware was updated from 13/50/99 to 16/21/D7 without any glitches. After the initial restart, everything look great and I even saw a screen explaining how the VR button on the steering wheel can be used for Siri commands (this was a first).

I had a few errands to run, so after making my next stop, I shut the car down as usual. But when I came back to the car, Bluetooth would no longer connect.

I tried everything. I even deleted the profile from the car and my phone and tried to reconnect. Nothing! Again, I got the issue where the car stops sending a bluetooth signal. So I couldn't even set my phone up as a recognized device until it decided to start functioning again. Ultimately it allowed me to re-establish the Bluetooth connection after about 3 more trips (with full shut down and start up).

It looks like things are just as bad as before for me. It’s promising to see that others are having success. It looks like I will need to go back to the dealership and see if there is a true hardware problem somewhere else. Within the last week, I have had the handsfree module replaced and updated my firmware without resolution.

**** it! Looks like I called it too early.

 

[AlphaWIP]

FYI on UConnect’s website, the last supported iOS version for our RB5 radio is 11.2.6... SMH

 

[dkarpouzos]

**** it! Looks like I called it too early.

Yeah, I think the update helped but it didn't completely solve my problem either. I seem to be connecting about 60% of the time now. Better than the 10% I was connecting before I guess.

 

[AlphaWIP]

https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf

This paper is an interesting read that shed some light on the inner workings of UConnect radios. According to the paper, the Bluetooth module is on the CAN bus. Granted, it’s the RA UConnect they’re talking about but I’m really curious if we can read messages emitted by the HFM on the CAN bus.

 

[futurezero]

Question: I saw that you were able to display song meta-data after a dealer firmware update. Does that mean the MTC display actually showed the Artist and track name when playing music from a mobile device via Bluetooth? My 2015 current just displays the name of my phone.

 

[AlphaWIP]

Question: I saw that you were able to display song meta-data after a dealer firmware update. Does that mean the MTC display actually showed the Artist and track name when playing music from a mobile device via Bluetooth? My 2015 current just displays the name of my phone.

Yes, artist and track name. Ask them to check your HFM firmware.

 

[futurezero]

Yes, artist and track name. Ask them to check your HFM firmware.

That is awesome! Thank you for the info. I will definitely be contacting my dealership. You have no idea how much happier this makes me ha

 

[AlphaWIP]

I kept digging and logged the BT traffic between MTC and my iPhone. I have successfully identified the EXACT problem that prevents MTC from connecting to our phones.

Here is the log for a successful connection:

And here's the log for an unsuccessful connection:

The single error that prevents MTC from connecting to my iPhone is: Connection Response - RFCOMM - Connection Refused - No Resources Available

I looked up the error online and it was very scarce. This post was somewhat relevant: https://stackoverflow.com/questions/52145779/linux-bluez-rfcomm-connection-refused

Interesting excerpts from the StackOverflow link:
"Q: ... The device was successfully paired. An RFCOMM connection to that device from Android or Windows can be successfully established, so the problem seems to be locaed with Bluez diver and/or blueotoothd.
With Linux/Bluez the bluetoothctl and Wireshark traces show that it fist connects and then after about 2 seconds a disconnection is done. The reason for the disconnection is not clear.
...
The same problem happens with different Linux releases...
...
I have checked numerous other thread having the same/similar problem. Most have no or no clear answer.
...
"
"A: ... This often happens when bluez doesn't have all the mandatory profiles which the device needs.
...
The incorrect RFCOMM channel was used. It instantly works when the correct RFCOMM channel is used.
"

Linux Bluez = the official Linux BT stack. If MTC is indeed running on Linux (which I suspect it is), this is probably simply an issue of misconfiguration or outdated Linux BT drivers.

Something else I observed: It seems MTC is still active and attempts to connect to my phone after the ignition is switched off and the car door opened.

Right now my hope is to unpack the KWI update file and see if I can mess with anything.

EDIT: Someone with the same symptoms (a different BT device though) and the engineers providing a solution: L2CAP connection refused with BLE_L2CAP_CH_STATUS_CODE_NO_RESOURCES - Nordic DevZone

Relevant Linux BlueZ source file: https://github.com/edrosten/bluez/blob/master/monitor/l2cap.c

 

[dkarpouzos]

Wow! And here I was thinking I was good at troubleshooting. My head just exploded. Thanks for sharing.

 

[CnoteMD]

AlphaWIP, that is amazing work. I consider myself reasonably technically literate, but this definitely went over my head. I have an appointment with my dealership next week.

I already did the MTC firmware update. Is it true that there is a firmware update for the handsfree module itself? When my phone is connected by Bluetooth, it does not show the artist or song name. The screen only shows the name of my phone. If there is another firmware update needed, this may help things a bit. My connection has deteriorated from 6-7 out of 10 to 1-2 out of 10.

I ultimately would like to have a Carplay system installed, but I want to make sure that my Bluetooth problem isn't a sign of another problem that would render an aftermarket system inoperable. Otherwise, I wouldn't devote so much time and energy to a solution.

 

[AlphaWIP]

AlphaWIP, that is amazing work. I consider myself reasonably technically literate, but this definitely went over my head. I have an appointment with my dealership next week.

I already did the MTC firmware update. Is it true that there is a firmware update for the handsfree module itself? When my phone is connected by Bluetooth, it does not show the artist or song name. The screen only shows the name of my phone. If there is another firmware update needed, this may help things a bit. My connection has deteriorated from 6-7 out of 10 to 1-2 out of 10.

I ultimately would like to have a Carplay system installed, but I want to make sure that my Bluetooth problem isn't a sign of another problem that would render an aftermarket system inoperable. Otherwise, I wouldn't devote so much time and energy to a solution.

Yes, there is a separate HFM update.

 

[AlphaWIP]

I've been attempting to dissect the KWI update file. I initially thought this was a standard Kiwi format used in the majority of Japanese-made radios (See here: Kiwi-W Consortium) because UConnect 8.4N is technically a Panasonic unit but the Russian-made KIWI file extractors could not read the file. I then used binwalk, a tool that specializes in firmware format identification and did an initial signature scan. The results are as follows:

[email protected] ~ % binwalk -B /Users/boyuanxu/Desktop/CTPMY14.KWI



DECIMAL HEXADECIMAL DESCRIPTION

--------------------------------------------------------------------------------

275404 0x433CC Copyright string: "Copyright (C) 2000 (2009) Renesas Technology Corp. and Renesas Solutions Corp. All rights reserved.HI7750/4(R0R40775TxW02x)V.2.0"

529124 0x812E4 CRC32 polynomial table, little endian

1967480 0x1E0578 MySQL MISAM index file Version 1

1972904 0x1E1AA8 MySQL MISAM index file Version 1

2500420 0x262744 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

2500469 0x262775 Copyright string: "Copyright Dolby Sweden AB (2008). "

2625888 0x281160 Copyright string: "Copyright (C) 2000 (2009) Renesas Technology Corp. and Renesas Solutions Corp. All rights reserved.HI7750/4(R0R40775TxW02x)V.2.0"

3443428 0x348AE4 MySQL MISAM index file Version 1

3448852 0x34A014 MySQL MISAM index file Version 1

4568776 0x45B6C8 Base64 standard index table

4571656 0x45C208 XML document, version: "1.0"

5031691 0x4CC70B Copyright string: "Copyright 1995-2002 Jean-loup Gailly "

5041435 0x4CED1B Copyright string: "Copyright 1995-2002 Mark Adler "

5071747 0x4D6383 LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 5763 bytes

5292372 0x50C154 XML document, version: "1.0"

5352224 0x51AB20 CRC32 polynomial table, little endian

7898384 0x788510 CRC32 polynomial table, little endian

8000900 0x7A1584 Ubiquiti firmware header, third party, ~CRC32: 0x6765735C, version: ""

8001039 0x7A160F Ubiquiti firmware header, third party, ~CRC32: 0x0, version: " -> SHORT"

8404592 0x803E70 CRC32 polynomial table, little endian

8859372 0x872EEC XML document, version: "1.0"

9510961 0x912031 Cisco IOS experimental microcode, for ""

9542384 0x919AF0 CRC32 polynomial table, little endian

10132828 0x9A9D5C Base64 standard index table

10147400 0x9AD648 Copyright string: "Copyright 1994-2004 Hitachi ULSI Systems Co.,Ltd.""

10185586 0x9B6B72 Copyright string: "Copyright 2000-2009 Hitachi ULSI Systems Co.,Ltd.""

10249776 0x9C6630 CRC32 polynomial table, little endian

10256547 0x9C80A3 Copyright string: "Copyright 1995-1998 Mark Adler "

10512604 0xA068DC Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

10512653 0xA0690D Copyright string: "Copyright Dolby Sweden AB (2008). "

11198052 0xAADE64 Boot section Start 0x8241 End 0x0

11233108 0xAB6754 Intel x86 or x64 microcode, sig 0x28200020, pf_mask 0x28200820, 2000-10-20, size 8192

11262180 0xABD8E4 Boot section Start 0x8241 End 0x0

12086653 0xB86D7D LZMA compressed data, properties: 0x90, dictionary size: 0 bytes, uncompressed size: 64 bytes

12241904 0xBACBF0 LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 512 bytes

12744511 0xC2773F LZMA compressed data, properties: 0xC0, dictionary size: 50331648 bytes, uncompressed size: 254 bytes

13011118 0xC688AE LZMA compressed data, properties: 0xC0, dictionary size: 0 bytes, uncompressed size: 32 bytes

63573368 0x3CA0D78 MySQL MISAM index file Version 1

63578792 0x3CA22A8 MySQL MISAM index file Version 1

64106308 0x3D22F44 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

64106357 0x3D22F75 Copyright string: "Copyright Dolby Sweden AB (2008). "

64231776 0x3D41960 Copyright string: "Copyright (C) 2000 (2009) Renesas Technology Corp. and Renesas Solutions Corp. All rights reserved.HI7750/4(R0R40775TxW02x)V.2.0"

65047516 0x3E08BDC MySQL MISAM index file Version 1

65052940 0x3E0A10C MySQL MISAM index file Version 1

66174148 0x3F1BCC4 Base64 standard index table

66177028 0x3F1C804 XML document, version: "1.0"

66636919 0x3F8CC77 Copyright string: "Copyright 1995-2002 Jean-loup Gailly "

66646723 0x3F8F2C3 Copyright string: "Copyright 1995-2002 Mark Adler "

66677039 0x3F9692F LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 5763 bytes

66892852 0x3FCB434 XML document, version: "1.0"

66952708 0x3FD9E04 CRC32 polynomial table, little endian

69349788 0x422319C CRC32 polynomial table, little endian

69452412 0x423C27C Ubiquiti firmware header, third party, ~CRC32: 0x6765735C, version: ""

69452551 0x423C307 Ubiquiti firmware header, third party, ~CRC32: 0x0, version: " -> SHORT"

69856104 0x429EB68 CRC32 polynomial table, little endian

70310884 0x430DBE4 XML document, version: "1.0"

71431336 0x441F4A8 Base64 standard index table

71445908 0x4422D94 Copyright string: "Copyright 1994-2004 Hitachi ULSI Systems Co.,Ltd.""

71484094 0x442C2BE Copyright string: "Copyright 2000-2009 Hitachi ULSI Systems Co.,Ltd.""

71548284 0x443BD7C CRC32 polynomial table, little endian

71555055 0x443D7EF Copyright string: "Copyright 1995-1998 Mark Adler "

71811112 0x447C028 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

71811161 0x447C059 Copyright string: "Copyright Dolby Sweden AB (2008). "

72032706 0x44B21C2 Copyright string: "Copyright 2004 by (URW)++ Design & DevelopmentNimbusSanLRegularURW:NimbusSanL-Reg:2004NimbusSanLVersion 1.05NimbusSanL-Reg"

125179256 0x7761578 MySQL MISAM index file Version 1

125184680 0x7762AA8 MySQL MISAM index file Version 1

125712196 0x77E3744 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

125712245 0x77E3775 Copyright string: "Copyright Dolby Sweden AB (2008). "

125837664 0x7802160 Copyright string: "Copyright (C) 2000 (2009) Renesas Technology Corp. and Renesas Solutions Corp. All rights reserved.HI7750/4(R0R40775TxW02x)V.2.0"

126653404 0x78C93DC MySQL MISAM index file Version 1

126658828 0x78CA90C MySQL MISAM index file Version 1

127780036 0x79DC4C4 Base64 standard index table

127782916 0x79DD004 XML document, version: "1.0"

128242807 0x7A4D477 Copyright string: "Copyright 1995-2002 Jean-loup Gailly "

128252611 0x7A4FAC3 Copyright string: "Copyright 1995-2002 Mark Adler "

128282927 0x7A5712F LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 5763 bytes

128498740 0x7A8BC34 XML document, version: "1.0"

128558596 0x7A9A604 CRC32 polynomial table, little endian

130955676 0x7CE399C CRC32 polynomial table, little endian

131058300 0x7CFCA7C Ubiquiti firmware header, third party, ~CRC32: 0x6765735C, version: ""

131058439 0x7CFCB07 Ubiquiti firmware header, third party, ~CRC32: 0x0, version: " -> SHORT"

131461992 0x7D5F368 CRC32 polynomial table, little endian

131916772 0x7DCE3E4 XML document, version: "1.0"

133037224 0x7EDFCA8 Base64 standard index table

133051796 0x7EE3594 Copyright string: "Copyright 1994-2004 Hitachi ULSI Systems Co.,Ltd.""

133089982 0x7EECABE Copyright string: "Copyright 2000-2009 Hitachi ULSI Systems Co.,Ltd.""

133154172 0x7EFC57C CRC32 polynomial table, little endian

133160943 0x7EFDFEF Copyright string: "Copyright 1995-1998 Mark Adler "

133417000 0x7F3C828 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

133417049 0x7F3C859 Copyright string: "Copyright Dolby Sweden AB (2008). "

133638594 0x7F729C2 Copyright string: "Copyright 2004 by (URW)++ Design & DevelopmentNimbusSanLRegularURW:NimbusSanL-Reg:2004NimbusSanLVersion 1.05NimbusSanL-Reg"

172965824 0xA4F3FC0 COBALT boot rom data (Flat boot rom or file system)

186785144 0xB221D78 MySQL MISAM index file Version 1

186790568 0xB2232A8 MySQL MISAM index file Version 1

187318084 0xB2A3F44 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

187318133 0xB2A3F75 Copyright string: "Copyright Dolby Sweden AB (2008). "

187443552 0xB2C2960 Copyright string: "Copyright (C) 2000 (2009) Renesas Technology Corp. and Renesas Solutions Corp. All rights reserved.HI7750/4(R0R40775TxW02x)V.2.0"

188259292 0xB389BDC MySQL MISAM index file Version 1

188264716 0xB38B10C MySQL MISAM index file Version 1

189385924 0xB49CCC4 Base64 standard index table

189388804 0xB49D804 XML document, version: "1.0"

189848695 0xB50DC77 Copyright string: "Copyright 1995-2002 Jean-loup Gailly "

189858499 0xB5102C3 Copyright string: "Copyright 1995-2002 Mark Adler "

189888815 0xB51792F LZMA compressed data, properties: 0x88, dictionary size: 0 bytes, uncompressed size: 5763 bytes

190104628 0xB54C434 XML document, version: "1.0"

190164484 0xB55AE04 CRC32 polynomial table, little endian

192561564 0xB7A419C CRC32 polynomial table, little endian

192664188 0xB7BD27C Ubiquiti firmware header, third party, ~CRC32: 0x6765735C, version: ""

192664327 0xB7BD307 Ubiquiti firmware header, third party, ~CRC32: 0x0, version: " -> SHORT"

193067880 0xB81FB68 CRC32 polynomial table, little endian

193522660 0xB88EBE4 XML document, version: "1.0"

194643112 0xB9A04A8 Base64 standard index table

194657684 0xB9A3D94 Copyright string: "Copyright 1994-2004 Hitachi ULSI Systems Co.,Ltd.""

194695870 0xB9AD2BE Copyright string: "Copyright 2000-2009 Hitachi ULSI Systems Co.,Ltd.""

194760060 0xB9BCD7C CRC32 polynomial table, little endian

194766831 0xB9BE7EF Copyright string: "Copyright 1995-1998 Mark Adler "

195022888 0xB9FD028 Copyright string: "Copyright Coding Technologies (1998 - 2007). (C) Copyright Dolby Sweden AB (2008). "

195022937 0xB9FD059 Copyright string: "Copyright Dolby Sweden AB (2008). "

195244482 0xBA331C2 Copyright string: "Copyright 2004 by (URW)++ Design & DevelopmentNimbusSanLRegularURW:NimbusSanL-Reg:2004NimbusSanLVersion 1.05NimbusSanL-Reg"

236342840 0xE164E38 MySQL MISAM index file Version 11

237153035 0xE22AB0B MySQL ISAM compressed data file Version 1

237728250 0xE2B71FA MySQL MISAM index file Version 7

238982790 0xE3E9686 MySQL ISAM index file Version 4

240791705 0xE5A3099 MySQL ISAM compressed data file Version 5

240945389 0xE5C88ED MySQL ISAM compressed data file Version 6

241645464 0xE673798 MySQL ISAM index file Version 3

241712641 0xE683E01 MySQL ISAM compressed data file Version 1

242872929 0xE79F261 MySQL ISAM index file Version 6

243576660 0xE84AF54 MySQL MISAM index file Version 11

247887354 0xEC675FA Copyright string: "Copyright (C) NEC Electronics 1997,2005"

247904362 0xEC6B86A Certificate in DER format (x509 v3), header length: 4, sequence length: 11309

248937978 0xED67DFA Copyright string: "Copyright (C) NEC Electronics 1997,2005"

248954986 0xED6C06A Certificate in DER format (x509 v3), header length: 4, sequence length: 11309

249001592 0xED77678 ARJ archive data, header size: 0, version 12, minimum version to extract: 2, compression method: compressed, file type: comment header, original file date: 1970-01-06 09:20:06, compressed file size: 465606, uncompressed file size: 10, os: MS-DOS

249001720 0xED776F8 ARJ archive data, header size: 0, version 12, minimum version to extract: 2, multi-volume, compression method: compressed most, file type: binary, original file date: 1970-01-06 09:20:06, compressed file size: 465606, uncompressed file size: 100, os: MS-DOS

 

[massi2015]

https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf

This paper is an interesting read that shed some light on the inner workings of UConnect radios. According to the paper, the Bluetooth module is on the CAN bus. Granted, it’s the RA UConnect they’re talking about but I’m really curious if we can read messages emitted by the HFM on the CAN bus.

THis is amazigg thank you so much i will be trying this tomorrow. So my car actually got stuck on “please wait. Loading” screen on the bluetooth screen. Idk whats wrong with it i attached a pic. If anyone has any idea. Please let me know.