Any help with working dump for CarlinKit 5.0 [CPC200-2air / U2AC]

[Debugx00]

Hi, my CPC200-2 air is not fully working, only the web interface, the red interface with the phone selection for carplay does not appear. The indicator lights up pink all the time, even when I try to flash it via usb using the update *.img file for U2AC (I've tried many flash drives). The firmware is updated via the web interface, but this does not help, the red interface still does not appear, although the phone can be connected (flashing blue)

I also attach screenshots from the web interface and a dump of my MX25L12835F chip.

MX25L12835F_04_01_2025_Neoprogrammer.zip

[Debugx00]

MX25L12835F_04_01_2025_Asprogrammer.zip

[ludwig-v]

Added V5 Stock Flash Dump ;)

[imedium3]

I installed the driver but i lost both wifi and BT, i restaured the Flash Dump and updated custom firmware but the BT and Wifi devices are not initiated

Software Vserion: 2024.01.10.0953
Start Main Service!!!

Please press Enter to activate this console. Thu Jan 2 00:00:02 UTC 2020
f_ptp.ko
f_ptp_appledev.ko
f_ptp_appledev2.ko
g_iphone.ko
storage_common.ko
g_android_accessory.ko
cdc_ncm.ko
console=ttyLogFile0 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=21e0000.qspi:256k(uboot),3328K(kernel),12800K(rootfs) rootwait quiet rw
BT WIFI Card Device ID: 0x4758
Start load Bluetooth!!!
End load Bluetooth!!!
Can't get device info: No such device
Reset Bluetooth!!!
killall: hciattach: no process killed
Start load Bluetooth!!!
End load Bluetooth!!!
Can't get device info: No such device
Reset Bluetooth!!!
killall: hciattach: no process killed
Start load Bluetooth!!!
End load Bluetooth!!!
Can't get device info: No such device
Reset Bluetooth!!!
killall: hciattach: no process killed
Start load Bluetooth!!!
End load Bluetooth!!!
rm: can't remove '/var/run/dbus/pid': No such file or directory

[imedium3]

@ludwig-v is it dead or i continue digging?
BT WIFI Card Device ID: 0x4758

[Zubastic]

Maybe try to change wifi drivers?

[imedium3]

I tried diffrent driver versions but i'm not sure whats exactly the problem with it, maily it was a V5 version i accidently wiped it now it works only with July U2AW V4 firmware.

[imedium3]

Hi there,

After using the V4 Flash Dump and updating to custom software version 2024.01.10.0953, I was able to restore Bluetooth functionality, but WiFi remains non-functional.

Interestingly, my Card Device ID is 0x4758. Upon inspecting the initialization script for the BT and WiFi card, I found that this ID is used to determine which driver to load. Since mine is different, I modified the script to load the BCM4358 driver when it detects Card Device ID: 0x4758. While this successfully restored Bluetooth, WiFi still fails to initialize properly. The system powers off WiFi after a brief check.

Do you have any insights on why this "invalid" ID is appearing? And is there a way to get WiFi working?

Thanks!

[ludwig-v]

Just had the same issue playing with it, change the settings to set "Carplay" instead of "Automatic" for HULink Type ;)

[Debugx00]

I did this, it didn't help. 😁

[ludwig-v]

I have a new unit coming tomorrow to make a new dump, they changed the direction of the chip the chip on V5 (I fried my Wifi chip putting it the same way as before)
Backup must be done off-board it seems, made my backup on-board (Didn't have any problem on V1 > V4)

[Debugx00]

I made a copy using asprogrammer without connecting carlinkit to the power supply. Then I flashed it back and everything is ok. But the binary copy made by neoprogrammer didn't work for some reason.

I'll be waiting for a new dump.

[ludwig-v]

Could you try "MX25L12835F_CFW_20210830_LGX4358_BROADCOM_SSH.BIN" I just uploaded, I think your Wifi chip is the Broadcom one
(You will be stuck at activation but you can play with SSH)

[Debugx00]

Tested...no boot, no led(carlinkit), red led(boot)

[imedium3]

Tested, no led, when i use USB drive the USB led flash

[Debugx00]

@ludwig-v Add info

{"CarInfo":{"brand":"","model":"","userid":"","year":0,"screen":"0x0","gnss":"","screenFps":"0","screenSize":"0x0","huid":""},"BoxInfo":{"bt":"AutoKit_78E","wifi":"AutoKit_A4","boxName":"AutoKit","MDLinkType":"","HULinkType":"","MDModel":"","MDOSVersion":"","MDLinkVersion":"","hardwareVer":"YMYE-WB58-0104","ver":"2024.10.31.1827","cgiVer":"Aug 9 2024 15:08:10","mfd":"20230419","uuid":"5d4805f8373eb9d78bb7b1749ebac455","productType":"U2AC_AUTOKIT","mac":"00:e0:4c:8b:03:1c","wifiChipType":4,"customVer":2,"customCode":"","platformType":"M6","fileName":"U2AC_AUTOKIT_Update.img","boxType":"YU","logFileSuffix":"YU2AC","tabId":"10","code":"BRw3jIcFaXgSOep5UCOnNQqODjqS5IxO","needActive":0},"Settings":{"fps":0,"gps":1,"lang":0,"bgMode":0,"syncMode":0,"startDelay":0,"mediaDelay":1000,"mediaSound":1,"autoConn":1,"echoDelay":320,"btCall":0,"micGain":0,"autoRefresh":0,"displaySize":0,"autoPlay":0,"mouseMode":1,"Udisk":1,"bitRate":0,"resolutionWidth":0,"resolutionHeight":0,"ScreenDPI":0,"KnobMode":0,"NaviAudio":0,"CallQuality":1,"autoUpdate":1,"wifi5GSwitch":1,"wifiChannel":36,"carLinkType":30,"RepeatKeyFrame":0,"BtAudio":0,"MicMode":0,"SpsPpsMode":0,"MediaPacketLen":200,"TtsPacketLen":200,"VrPacketLen":200,"TtsVolumGain":0,"VrVolumGain":0,"heartBeat":1,"emptyFrame":1,"micType":0,"autoDisplay":1,"connectedMode":1,"transMode":0,"returnMode":0,"backRecording":0,"fastConnect":0,"improvedFluency":0,"naviVolume":0,"originalRes":0},"DevList":[],"LangList":[],"WifiChannelList":[{"id":1,"wifiFreq":2412},{"id":2,"wifiFreq":2417},{"id":3,"wifiFreq":2422},{"id":4,"wifiFreq":2427},{"id":5,"wifiFreq":2432},{"id":6,"wifiFreq":2437},{"id":7,"wifiFreq":2442},{"id":8,"wifiFreq":2447},{"id":10,"wifiFreq":2457},{"id":11,"wifiFreq":2462},{"id":13,"wifiFreq":2472},{"id":36,"wifiFreq":5180},{"id":40,"wifiFreq":5200},{"id":44,"wifiFreq":5220},{"id":48,"wifiFreq":5240},{"id":149,"wifiFreq":5745},{"id":153,"wifiFreq":5765},{"id":157,"wifiFreq":5785},{"id":161,"wifiFreq":5805},{"id":165,"wifiFreq":5825}],"ModuleInfo":[{"name":"Boot128","version":"2024.03.21.1830"},{"name":"USBDrv","version":"2024.07.05.1816"},{"name":"Common","version":"2024.07.19.1729"},{"name":"Service","version":"2024.07.20.0937"},{"name":"Upg","version":"0000.00.00.0000"},{"name":"HUCP","version":"2024.10.31.1827"},{"name":"HUAA","version":"2024.07.19.1717"},{"name":"CarPlay","version":"2024.07.20.0933"},{"name":"AndroidAuto","version":"2024.07.19.1730"},{"name":"BCM4358","version":"2024.10.31.1827"},{"name":"WebAUTOKIT","version":"2024.08.14.1044"},{"name":"Cus_U2AC_AUTOKIT","version":"2024.03.21.1829"}]}

[ludwig-v]

Uploaded the new dump from the new unit, off-board to avoid any corruption ;)

[Debugx00]

As before, nothing new, the boot LED (small red and green diodes) flashes green once and no longer glows. Carlinkit LED does not light up.

It looks like I have one of the initial versions of V5 (CPC200-2Air), something between V4 and V5 heh :D

[ludwig-v]

I uploaded another .img found on their server, try it

[Debugx00]

I tried to upload the img to a flash drive, and again, the flash drive is not recognized by the unit.

I have even tried changing the partition table on the flash drive (MBR/GPT), based on the experience of detecting flash drives in Audi, the MHI2Q head unit, it detects only MBR/FAT32

[Debugx00]

Anyway, thanks for the help. Now I will try to communicate with the guys from carlinkit on aliexpress and send them tons of feedback from the web interface xD

[ludwig-v]

If you don't care about V5 you just have to reupload V4 dump, and reflash it via USB to fix Wifi connection ;)

[Debugx00]

I tried, it didn't work, my unit doesn't want to accept flash drives at all 😂

I also want to say that the firmware 2024.10.31.1827 is a beta firmware 🫡

[Debugx00]

@ludwig-v

They released another firmware for me, as usual it didn't help, but you can add it to the firmware list for U2AC (V5)

[ludwig-v]

Hi ! You can root your device by following: https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/tree/master/Flash_Dump/Tools
Maybe it will help digging yourself checking internal logs and also check if your USB drive is correctly detected and mounted inside /mnt/UPAN, Carlinkit is useless :)

[Debugx00]

Thanks, I'll try. They also sent me a new full firmware and again in the hwfs format, they said that not the img format is ok. xD

U2AC_AUTOKIT_Update.hwfs

[Debugx00]

@ludwig-v

Another of the latest firmware updates from support, also beta. As always, it didn't help, so they said there's nothing more we can do, you can try to return it to production so they can look at it.

MX25L12835F_Asprogrammer_09_01_2025.zip

[Debugx00]

@ludwig-v

As I wrote above, I tried to make rootFS for the u2w script to work, but nothing new, the flash drive is not recognized. I also tried to flash the dump from v4+u2w, and nothing either, the flash drive is not recognized, apparently this is a problem in the hardware part. Thank you for your help and such a lot of work in the research.

[Zubastic]

Well, are u sure that flash drive not recognized at all?

[mival]

@Debugx00 I don't think that is hardware problem. I have exactly same problems. I also tried all mentioned firmware without luck. I can't event see dongle wifi. Is there any trick how you get wifi connection? My board is the same v06.2 release

[ludwig-v]

You can now flash a custom firmware file to get root access and SSH to check what's wrong directly by checking the content of dmesg, /tmp/ttyLog, and so on ;)

[ludwig-v]

You tried .img instead of .hwfs ? Seems like .hwfs files are not working properly

[mival]

@ludwig-v i tried this https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/blob/master/Custom_Firmware/U2AC/_AUTOKIT/2024.01.18.1053/U2AC_AUTOKIT_Update.img using 16Gb FAT32 USB drive and nothing happened. In my opinion problem is that none of (binary) firmware not detect USB drive and also most of them not boot

[ludwig-v]

Without USB and without Wifi it is going to be very hard to know what's wrong, unfortunately

[imedium3]

Hi There, apologies about jumping in this conversation :) i have an issue with wifi that seems not intiating properly, i'm using custom firmware 18.01.2024.1053 version with usb debug

cat: can't open '/sys/class/net/wlan0/address': No such file or directory

Device UUID: 6523243f241899d7f08a495b656067a4
Device Old UUID: 10a2e3bab9e832ea9e5424fc4cc44b95
Device Manufacturer: GuanSheng
Device Version: 2
Device Type: U2AC_AUTOKIT
Device Custom Type:
Device Wifi: Broadcom 4358
Software Activated Brands: ALL_CAR
Software Version: 2024.01.18.1053

LOG

[D]2020-01-02 00:00:25.382 188-76f29000/ARMadb-driver[Accessory_fd]: SendPhoneCommandToCar: SupportAutoConnect(1001)
[D]2020-01-02 00:00:25.383 188-7689d450/ARMadb-driver[RiddlePlatform]: brandSsidName: AutoKit_144, ssidSuffixLen: 3, 11-8
01-02 12:00:25.386638 AM [RiddleBluetoothService_Interface_Control] OnDbusSignal org.riddle.BluetoothControl:Listen
01-02 12:00:25.386979 AM [RiddleBluetoothService_Interface_Control] RiddleBluetoothService_Interface_Control::OnDbusMessage Listen
01-02 12:00:25.387253 AM [RiddleBluetoothService_Interface_Control] StartListen_Inner beListened = 0
name "AutoKit_144";
[D]2020-01-02 00:00:25.403 188-7689d450/ARMadb-driver[RiddlePlatform]: Box bluetooth name: AutoKit_144 is same as old, do nothing
[D]2020-01-02 00:00:25.403 188-7689d450/ARMadb-driver[RiddlePlatform]: ssid: AutoKit_, ssidSuffixLen: 2
[D]2020-01-02 00:00:25.404 188-7689d450/ARMadb-driver[RiddlePlatform]: brandSsidName: AutoKit_92, ssidSuffixLen: 2, 10-8
ssid=AutoKit_92
[D]2020-01-02 00:00:25.418 188-7689d450/ARMadb-driver[RiddlePlatform]: Box WiFi name: AutoKit_92 is same as old, do nothing
[D]2020-01-02 00:00:25.418 188-7689d450/ARMadb-driver[Accessory_fd]: start wifi!!!
config wifi channel: 11, freq: 2462
2.4G wifi
channel=11
wpa_passphrase=12345678
[D]2020-01-02 00:00:25.529 188-76f29000/ARMadb-driver[main]: _hu_link_main start
[D]2020-01-02 00:00:25.531 188-76f29000/ARMadb-driver[RiddlePlatform]: BoxUUID: 6523243f241899d7f08a495b656067a4
[D]2020-01-02 00:00:25.531 188-76f29000/ARMadb-driver[RiddlePlatform]: GetCacheBoxUUID: 6523243f241899d7f08a495b656067a4
01-02 12:00:25.610388 AM [BluetoothSocket_fd] $$$ Bluetooth StartListen IAP2!!!
01-02 12:00:25.610831 AM [BluetoothSocket_fd] $$$ Bluetooth StartListen NEARBY!!!
01-02 12:00:25.611052 AM [BluetoothSocket_fd] $$$ Bluetooth StartListen AAP!!!
01-02 12:00:25.611972 AM [RiddleBluetoothService_Interface_Control] OnDbusSignal <>:<>
01-02 12:00:25.612150 AM [RiddleBluetoothService_Interface_Control] OnDbusSignal org.bluez.Adapter:ModeChanged
01-02 12:00:25.612247 AM [RiddleBluetoothService_Interface_Control] ModeChanged discoverable
01-02 12:00:25.612323 AM [RiddleBluetoothService_Interface_Control] OnDbusSignal org.bluez.Adapter:PropertyChanged
hostapd start process.....
Configuration file: /etc/hostapd.conf
Could not read interface wlan0 flags: No such device
nl80211: Driver does not support authentication/association or connect commands
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
Could not read interface wlan0 flags: No such device
nl80211 driver initialization failed.
wlan0: interface state UNINITIALIZED->DISABLED
wlan0: AP-DISABLED
wlan0: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface wlan0 wasn't started
Set WLAN0 IP: 192.168.50
$$$ 清除发送缓冲，因为fd已经不可用
$$$ 清除发送缓冲，因为fd已经不可用
$$$ 清除发送缓冲，因为fd已经不可用
[D]2020-01-02 00:00:25.841 188-76f29000/ARMadb-driver[MiddleManInterface]: pid:193 Control-InternalUse(30) connected, fd=6
[E]2020-01-02 00:00:25.841 188-76f29000/ARMadb-driver[Accessory_fd]: Not Opened!!
$$$ 清除发送缓冲，因为fd已经不可用
[W]2020-01-02 00:00:25.843 188-76f29000/ARMadb-driver[main]: Ignore Linux Hub device hotplug message!
Same IP, no need to reset
/script/start_bluetooth_wifi.sh: line 131: can't create /proc/sys/net/ipv6/conf/wlan0/disable_ipv6: nonexistent directory
ifconfig: SIOCSIFADDR: No such device
udhcpd start process.....

[imedium3]

@ludwig-v i tried this https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/blob/master/Custom_Firmware/U2AC/_AUTOKIT/2024.01.18.1053/U2AC_AUTOKIT_Update.img using 16Gb FAT32 USB drive and nothing happened. In my opinion problem is that none of (binary) firmware not detect USB drive and also most of them not boot

Try 8gb flash drive, firstly i couldn't do anything with 32gb and 16gb new drives, i found an old one with LED on it and i see that its copying files etc

[ninja-]

has anyone figured some of the debug pins on the PCB of C2A 5.0? I am looking for ways to get it into uboot download mode.

Seems like that comment from README is out of date or relates to another device

The device can be seen as "SP Blank 6ULL" when powered by USB-OTG but it is not possible to flash a custom u-boot using imx_usb because it is signed

no matter what I try, it will go straight to normal boot. it should be possible to flash a custom uboot btw. as the fuses say secure boot is completely off in this device.

[ninja-]

nevermind, that's impossible. it's fused to ignore USB download mode in all cases, including both the magic pins and the trick with shorting pins on flash module during boot in which cases many versions of u-boot force download/recovery mode

[ninja-]

I am looking if it's possible to flash a custom kernel instead of their crap one.
(it won't be usable by itself, only when paired with fully custom firmware)

Unfortunately, even though there's no standard NXP decryption/verification on it, there's a hidden surprise, they patched uboot with a completemy custom decrypt-decompress process for kernel and /dev/mtd1 which is supposed to be the kernel, is encrypted garbage :D

I assume no one tried cracking this one before?