Honda Hack / Root: 11th Gen - Work In Progress Discoveries

[sgtmorph]

Appreciate the efforts. Looking
forward to potential upgrades/updates that might result from this.

Sponsored

 

[eric__]

Took delivery on my 2022 Sport Hatchback (Canada). I love this car, but disappointed the 7in. display doesn't even seem to be android (I'm 70% sure; the software version reported isn't an Android one)

I've found two hidden menus in addition to the one in post #11. The process is much the same but uses additional buttons:

"Developer Diagnostic" Menu:
1. Power off the radio
2. While holding down Phone and Connect, and Menu, Press the power button 5 times and DO NOT release Phone, Connect, and Menu.
3. Keep holding Phone, Connect, and Menu for ~5 sec.

The Developer Diagnostics menu comes up with the following items:
DD VSP Error (defaulted to "on")
- Steer angle adjustment result
- Steer angle setting
- Bluetooth information
- Touch panel check
- Display check
- Gamma adjustment
- BMP display

I have not reviewed anything inside these menus yet.

The other hidden menu is called "Authentication Diag" and contains settings for changing the USB to Host/Device mode (among other things). I am hoping this would be a starting point for head unit mods.

Similar to the above, hold down three keys for ~5 seconds after hitting the power button 5 times. I've added a sample screenshot for clarity.

"Authentication Diag" menu:
1. Power off the radio
2. While holding down Phone and Connect, and Back, Press the power button 5 times and DO NOT release Phone, Connect, and Back.
3. Keep holding Phone, Connect, and Back for ~5 sec.

The "Authentication Diag" menu comes up with the following items:
- USB mode change
- Apple CarPlay performance test
- USB hub mode (defaulted to off)
- Bluetooth test

The USB mode lets you toggle between Host & Device mode. Changing the setting seems a bit "flaky" and usually won't allow to select one or the other unless I leave the menu and come back in a few times. It often, but not always, allows me to change to "device" by holding down the button for around 5 seconds and then repeatedly tapping it to get the setting to "stick".

I haven't yet successfully been able to get any farther with this; in Device mode the head unit doesn't recognize either my phone or my computer attached to USB. As I mentioned, the software doesn't even seem to be Android. None of the info provided earlier in this thread seems to apply to the 7in screen (at least, not for Canada) except for the video clip in post #8 and the settings for the EQ in post #11.

I'd love to hear if anyone is able to do anything further with this info & make progress on getting a USB connection to PC.

** Edit** I've also found that either of these two menus can be accessed simply by holding down either the "Back" button or the "Menu" button for 5 sec once you're inside the main "Detailed Information & Setting", which is accessed with just holding Phone and Connect & Pressing the power button 5 times (Posts 8/ 11).

I was able to get the adb device to show as unauthorized now on my touring 9" screen as well. I have not figured out how to replicate buttons to find an Authentication Diag screen like you were able to find on your head unit. I definitely think this is the right track. Once we can flip the device to authorized it should allow full root capabilities.

 

[eric__]

I ripped open my car last night to take a look at any identifying serial numbers that may help with further information.

Here is the information on the 9" touring screen.

The screen is separate from the radio itself. Here is the numbers on the radio:

Fortunately for us, anything that communicates over radio frequency has to have documentation sent to the FCC. So searching the FCC ID nets this link: https://fcc.report/FCC-ID/ACJ932AH2001 and also similar info here: https://fccid.io/ACJ932AH2001

It includes some schematics and a user manual. The user manual seems incorrect, that manual shows buttons on both sides like the sport model. But wanted to share. I'm continuing to dig in the files from the FCC and also in the dev menus on the radio.

 

[xlestergg]

I ripped open my car last night to take a look at any identifying serial numbers that may help with further information.

Here is the information on the 9" touring screen.

The screen is separate from the radio itself. Here is the numbers on the radio:

Fortunately for us, anything that communicates over radio frequency has to have documentation sent to the FCC. So searching the FCC ID nets this link: https://fcc.report/FCC-ID/ACJ932AH2001 and also similar info here: https://fccid.io/ACJ932AH2001

It includes some schematics and a user manual. The user manual seems incorrect, that manual shows buttons on both sides like the sport model. But wanted to share. I'm continuing to dig in the files from the FCC and also in the dev menus on the radio.

Comparing your pictures to https://www.ebay.com/itm/234392685649 , the connector/ports looks to be very different across the 2 models. Is the photo which shows the ports in the ebay link from the radio and your photo is from the 9" touring screen and not the radio?

 

[eric__]

Comparing your pictures to https://www.ebay.com/itm/234392685649 , the connector/ports looks to be very different across the 2 models. Is the photo which shows the ports in the ebay link from the radio and your photo is from the 9" touring screen and not the radio?

Interesting! The 7” radio is directly connected to the screen. Mine is not!

here’s some more context. The screen is just mounted on its own with two sets of wires. The actual head unit is under the vents.

Here’s behind the screen. For the touring it’s a speaker that I removed.

the actual unit is the metal box in the center of the photo with the white stickers.

it makes me wonder if the 7” has software differences too so whatever methods could work on the 9” unit may not work on the 7“ and vice versa.

 

[xlestergg]

Interesting! The 7” radio is directly connected to the screen. Mine is not!

here’s some more context. The screen is just mounted on its own with two sets of wires. The actual head unit is under the vents.

Here’s behind the screen. For the touring it’s a speaker that I removed.

the actual unit is the metal box in the center of the photo with the white stickers.

it makes me wonder if the 7” has software differences too so whatever methods could work on the 9” unit may not work on the 7“ and vice versa.

The software is different for sure, you could do many things on the 9" without connecting your phone to Android Auto/ Carplay, on the 7" there's almost nothing you can do except listening to the radio. In the 9" you can change many of the safety related features I believe. The diagnosis screen for the 9" is the orange screen while the 7" is the somewhat more colorless.

 

[iLLNESS]

So I tried several combinations of setting the USB mode to ADB mode, and also going into General Settings > System > Developer Options > Developer Option and enabling USB debugging. However no matter what I tried, my computer would not connect to the head unit. I also noticed that the ADB mode usb mode seemed to just turn off power completely to the port and nothing worked.

I did find another hidden menu like the 10th gen civics had, but the Disable Android Restriction Button is gone from that menu as well.

After holding HOME + POWER + BACK to get into the Diagnosis menu, click the bottom button for Detailed Information & Setting.

Now on the Detailed Information & Setting screen, hold the HOME button for about 5 seconds.

That takes you to the Developer Diagnosis Menu. I tried checking every single menu in here but the Special function setting stuck out to me from watching videos on the 19-21 Civic Honda Hack videos.

However clicking it just nets you this:

And clicking that button just shows you a toggle switch.

I tried holding some combination of buttons on this screen but nothing worked there.

I'm leaving this thread up for now in case anyone else takes on this endeavor for Honda Hack in 11th Gen. But it does not look promising as of yet.

My experience has been essentially the same as yours.

I tried messing around with revoking access/timing debugging on off/rebooting during plugin/etc... no matter what I remain sitting at unauthorized for the adb connection.

There has to be some new button combination to allow authorization/give us another developer menu.

Additionally I went through most every app/menu item to see if there were some sort of small browser functions built in that could be used as a MITM DNS redirect to load up our own web pages in that app/menu but didn't see any sort of indication to support that thought.

 

[eric__]

My experience has been essentially the same as yours.

I tried messing around with revoking access/timing debugging on off/rebooting during plugin/etc... no matter what I remain sitting at unauthorized for the adb connection.

There has to be some new button combination to allow authorization/give us another developer menu.

Additionally I went through most every app/menu item to see if there were some sort of small browser functions built in that could be used as a MITM DNS redirect to load up our own web pages in that app/menu but didn't see any sort of indication to support that thought.

Buried in the developer settings does show there is the default android web view installed, but I couldn’t figure out how to launch it. I also tried looking for links in the licenses but they’ve all been sanitized too.

that’s my thought as well. 10th gen was once you did the first menu and clicked the detailed settings, you held the buttons to go into another menu but then there was a third menu for setting host to usb. I’ve tried for like 6 hours this past week doing all sorts of button combinations on all those screens. No dice yet.

I know there is an app installer and it follows a whitelist. But looks like that route has been checked before and may not be able to spoof anything there. https://www.insideevsforum.com/community/index.php?threads/app-installer.8582/#post-96501

 

[DeviNoles]

I ripped open my car last night to take a look at any identifying serial numbers that may help with further information.

Here is the information on the 9" touring screen.

The screen is separate from the radio itself. Here is the numbers on the radio:

Fortunately for us, anything that communicates over radio frequency has to have documentation sent to the FCC. So searching the FCC ID nets this link: https://fcc.report/FCC-ID/ACJ932AH2001 and also similar info here: https://fccid.io/ACJ932AH2001

It includes some schematics and a user manual. The user manual seems incorrect, that manual shows buttons on both sides like the sport model. But wanted to share. I'm continuing to dig in the files from the FCC and also in the dev menus on the radio.

Here's a picture of the 7" radio.

 

[Jm5522]

Following

 

[sgtmorph]

Following

damn you!

I got excited thinking some progress was made lol

 

[Wsilver]

I have browser in my inactive apps menu. It says active but it does not appear in my apps

 

[DeviNoles]

I have browser in my inactive apps menu. It says active but it does not appear in my apps

Try holding it.

 

[Wsilver]

I tried tapping, holding, sliding. It just makes a little visual wave indicating it was tapped, but nothing changes or opens up. Same for everything in this menu

 

[Fever308]

Just a note, idk if it's helpful. But if you go to the Detailed Information & Setting menu on the 9 inch, click Functional Setup, under Save User's memory if you have a USB drive plugged it it'll create an Android backup .ab file. After some research it looks like you can unpack and repack this file with a program as long as it's not password protected. You can then reimport the file from the same menu. I know at least a similar method was used to install apps on a 2018 accord. But the password was known for that file.

Sponsored