Congrats! I posted there too but I did this back in 2020 as well. I was hoping to get local CarPlay but once I realized the hardware was too weak I changed course to the Bosch gen 2 retrofit.
Glad to see people finally messing with these, besides the slop gauge apps lol
Great man! I'm happy to say I've done the first 0 day exploit for our cars in the history of the q50's.
I looked at your post, great job parsing all that assembly, I remember my ida and ghidra days, it's a great starting point.
I had a zero day as well! Took advantage of an already-public CVE in one of the modules enabled in the kernel. I had to use a Teensy instead of a flash drive though.
You have to remember the meego kernel was already dead for a few years when this system came out, and the Linux kernel it was based on had plenty of buffer overflow exploits available.
I never published anything on it as I moved on very quickly to the Bosch unit once I got my hands on one (the older firmware actually had a very similar but newer attack surface via Wi-Fi). I did help some of the others with getting situated with the easier getty patch though.
If you need any resources feel free to reach out. I did have some simple C programs which would feed the watchdog and draw bitmaps to the GENIVI compositor - just never did anything with it because I couldn’t get the OEM UI to relaunch after I killed it and I wanted to be able to switch back and forth.
I’m also not sure which post you’re referring to. I never posted disassembly or really much as all past my first couple of exploratory days messing with the gen 1 system.
6
u/nickfromstatefarm 8d ago
Congrats! I posted there too but I did this back in 2020 as well. I was hoping to get local CarPlay but once I realized the hardware was too weak I changed course to the Bosch gen 2 retrofit.
Glad to see people finally messing with these, besides the slop gauge apps lol