Hacking UConnect update data

Discussion in 'Audio & Electronics' started by LoneJeeper, Jan 3, 2017.

  1. LoneJeeper

    LoneJeeper Junior Member

    Age:
    37
    Posts:
    9
    Likes Received:
    1
    Joined:
    Jan 3, 2017
    Location:
    Earth
    Ram Year:
    2013
    Engine:
    Hemi 5.7
    Hello all.

    Perhaps my google-fu is failing me, as I didn't find much related to what I'm up to.... so far what I've found is interesting.

    I have a fair amount of hardware and software hacking experience under my belt, so when I found out that I'm eligible for a UConnect update, and that I can apply it myself the wheels in my brain started turning. At this point, I'm mostly curious as to if this has been explored or if anyone has a source on it that I couldn't find.

    It is possible to 'explode' the update file, explore the updates' file structure, files themselves, make edits, recompile the update files and the truck will use this new data to update the UConnect system.

    Obviously, the usual warnings and caveats regarding warranty, bricking, etc all apply here.... I also think it is a huge mistake to put these files into the hands of end users as opposed to it being a dealer-only operation.

    I've only given this a couple hours, but I've found where I could change dashboard colors, icons, and some text. It appears I can also export a system backup back out to my USB drive and run whatever shell commands I'd want. My end goal is to have my truck connect to the wireless internet at my house and transfer files to USB storage.

    Other interesting finds:

    Proxy options:
    * Set up the truck to proxy all traffic through my home lab.
    * This lets me see what requests and data are being sent/received and intercept any/all files, plus inject my own.

    Sat/Nav setup options:
    * I have Sat/Nav, so I'd have to see how other update files differ, but perhaps you could enable it through here.

    Cameras:
    * I have seen some camera information in the .lua code, need to dig here more.

    Button action data:
    * decompiling the *.swf files, I've seen some ActionScript concerning button names and corresponding scripts which I'd have to pull from the filesystem, but I can run my own edited .sh scrips... I just don't know, yet, how to trigger a second update once I've got those files.


    I haven't yet seen where there is any tamper detection or MD5/SHA checksum going on, nor have I found where it is tied to the VIN. Given the RAX hack needs the VIN, it's probably in there somewhere I haven't found... I expect a method very similar to what I'm up to is used in the RAX kit.

    So, anyone else know of some research into this area?
     
    SitKneelBend likes this.
  2. lowvaluetarget

    lowvaluetarget Member

    Posts:
    98
    Likes Received:
    41
    Joined:
    Dec 5, 2016
    Ram Year:
    2014
    Engine:
    Hemi 5.7
    This is interesting. I'll have to take a look.
     
  3. LoneJeeper

    LoneJeeper Junior Member

    Age:
    37
    Posts:
    9
    Likes Received:
    1
    Joined:
    Jan 3, 2017
    Location:
    Earth
    Ram Year:
    2013
    Engine:
    Hemi 5.7
    Some of the Theme spec, looks like most of the interface is .swf. There's a call for the wallpaper toward the end.

    I'd be glad to share any/all of what I have or have found.

     
  4. LoneJeeper

    LoneJeeper Junior Member

    Age:
    37
    Posts:
    9
    Likes Received:
    1
    Joined:
    Jan 3, 2017
    Location:
    Earth
    Ram Year:
    2013
    Engine:
    Hemi 5.7
  5. 00R/T

    00R/T Supporting Member

    Posts:
    1,448
    Likes Received:
    894
    Joined:
    Apr 18, 2016
    Location:
    CT
    Ram Year:
    2013
    Engine:
    5.7 HEMI
    There's a guy on a Jeep forum that has done some promising work. There is a checksum verification in the boot loader, but it may be possible to bypass it. I messed with the files for a few days but ended up putting it on the back burner because I wanted to focus my tinkering time on my CAN bus projects.

    I'm looking forward to seeing what you find.
     
    R.L.K. and SitKneelBend like this.
  6. BAMF

    BAMF Senior Member

    Posts:
    115
    Likes Received:
    30
    Joined:
    May 29, 2016
    Location:
    Southern Louisiana
    Ram Year:
    2015 Big Horn
    Engine:
    Hemi 5.7
    Way over my head.... Haha. Interesting though

    Sent from my SM-N910V using Tapatalk
     
    R.L.K. likes this.
  7. tcazes

    tcazes Senior Member

    Posts:
    194
    Likes Received:
    47
    Joined:
    Dec 7, 2016
    Ram Year:
    2013
    Engine:
    5.7L
    I'd love to find an ability to manipulate the comfort settings to adjust the auto on air conditioned seat function at a lower temp like say 72. I hate having to click the air seats on every time lol first world problems.
     
    adrianp89 likes this.
  8. adrianp89

    adrianp89 Senior Member

    Age:
    28
    Posts:
    1,955
    Likes Received:
    627
    Joined:
    Sep 3, 2015
    Location:
    Tampa Bay, FL
    Ram Year:
    2013
    Engine:
    Hemi 5.7
    ^^ This, except I want opposite lol. I want heated seats to turn on at 65.
     
  9. tcazes

    tcazes Senior Member

    Posts:
    194
    Likes Received:
    47
    Joined:
    Dec 7, 2016
    Ram Year:
    2013
    Engine:
    5.7L
    Lol you and my wife both. I'd like heat to kick on at 55-60 and below and air to come on around 70-72 and above
     
  10. Ram Man

    Ram Man Senior Member

    Posts:
    473
    Likes Received:
    94
    Joined:
    Jul 1, 2010
    Location:
    FL
    Ram Year:
    2013 Sport
    Engine:
    5.7
    These are my favorite types of threads. Taking the path less followed!

    The different color schemes only apply to the newer model uconnects so it would be awesome to have them on the 13 too!

    Check out mr_z_automotive on Instagram or zautotech.com, I have been following him for awhile, he does some great work on the uconnects in chargers/challengers.
     

Share This Page