C-Class (W204) 2008 - 2014: C180K, C200K, C230, C280, C300, C350, C200CDI, C220CDI, C320CDI

Get VIM by doing a Hard Drive Hack

Thread Tools
 
Search this Thread
 
Rate Thread
 
Old 10-01-2009, 09:32 AM
  #76  
Member
 
mirage15's Avatar
 
Join Date: Jul 2009
Posts: 97
Likes: 0
Received 0 Likes on 0 Posts
c300 4matic
They are "automotive" grade 2.5" IDE drives. SSDs may actually be a good option if you can get them in 2.5 IDEs. I think most are SATA these days but I could be very wrong. I try to not llow hardware trends
Old 10-01-2009, 09:36 AM
  #77  
Member
 
matthew121170's Avatar
 
Join Date: Apr 2009
Location: Virginia
Posts: 171
Received 4 Likes on 4 Posts
2012 E350 - Cabrio; 2017 GLS 450
True, but will the command system take a "ghosted" drive? All this is fine and dandy but if a ghost will not work, it really does not matter.
Old 10-01-2009, 09:42 AM
  #78  
Member
 
mirage15's Avatar
 
Join Date: Jul 2009
Posts: 97
Likes: 0
Received 0 Likes on 0 Posts
c300 4matic
I dont see a reason that it wouldn't. It has no idea the drive was ghosted.. I believe the Mitsu guys have installed larger drives already so I dont see that as an issue.
Old 10-01-2009, 09:45 AM
  #79  
Member
 
matthew121170's Avatar
 
Join Date: Apr 2009
Location: Virginia
Posts: 171
Received 4 Likes on 4 Posts
2012 E350 - Cabrio; 2017 GLS 450
i don't know if it is either, i mean they have to have some way of getting the software on all those drives....
Old 10-15-2009, 07:35 PM
  #80  
Member
 
mirage15's Avatar
 
Join Date: Jul 2009
Posts: 97
Likes: 0
Received 0 Likes on 0 Posts
c300 4matic
Just to bring this subject alive again...

I have been working on this with Kurosen and Otaku for a little while now. Vic hooked us up with the firmware disk (Thanks Vic!) and I may have found something in there. I have an email out to the other guys to see if it is real or not... We will keep you posted
Old 10-15-2009, 08:37 PM
  #81  
MBWorld Fanatic!
 
BerBer63's Avatar
 
Join Date: Aug 2008
Location: Los Angeles
Posts: 2,257
Received 10 Likes on 7 Posts
2009 C63
Originally Posted by mirage15
Just to bring this subject alive again...

I have been working on this with Kurosen and Otaku for a little while now. Vic hooked us up with the firmware disk (Thanks Vic!) and I may have found something in there. I have an email out to the other guys to see if it is real or not... We will keep you posted
God bless you my child.
Old 10-15-2009, 08:44 PM
  #82  
Member
 
matthew121170's Avatar
 
Join Date: Apr 2009
Location: Virginia
Posts: 171
Received 4 Likes on 4 Posts
2012 E350 - Cabrio; 2017 GLS 450
Originally Posted by mirage15
Just to bring this subject alive again...

I have been working on this with Kurosen and Otaku for a little while now. Vic hooked us up with the firmware disk (Thanks Vic!) and I may have found something in there. I have an email out to the other guys to see if it is real or not... We will keep you posted
If you could figure it out, then you would be king of the world!
Old 10-15-2009, 09:04 PM
  #83  
Member
 
mirage15's Avatar
 
Join Date: Jul 2009
Posts: 97
Likes: 0
Received 0 Likes on 0 Posts
c300 4matic
Well if (big IF) this does end up being the code that needs changed... it is only one step. We still have to get this actually updated on the system. Of course that should be less of an issue than actually finding the code
Old 10-15-2009, 10:03 PM
  #84  
Senior Member
 
whkento's Avatar
 
Join Date: Jul 2008
Location: Nagoya, Japan
Posts: 373
Received 1 Like on 1 Post
'15 C200 AMG line, '08 C300 Sport Avantgarde, '07 Jeep Grand Cherokee Ltd, '02 CLK 200 (gone)
Originally Posted by matthew121170
If you could figure it out, then you would be king of the world!
Absolutely!
Old 10-20-2009, 07:09 PM
  #85  
Member
 
Draz's Avatar
 
Join Date: Dec 2008
Posts: 97
Likes: 0
Received 4 Likes on 4 Posts
2012 MB E350 Coupe
Originally Posted by mirage15
Well if (big IF) this does end up being the code that needs changed... it is only one step. We still have to get this actually updated on the system. Of course that should be less of an issue than actually finding the code
Mirage, any news, how close are you?
Old 10-20-2009, 07:26 PM
  #86  
Member
 
mirage15's Avatar
 
Join Date: Jul 2009
Posts: 97
Likes: 0
Received 0 Likes on 0 Posts
c300 4matic
I think we are close to having it but still haven't gotten there. We have been working on getting the load worked out. After that code updates shouldn't be much of a problem. Work seems to be getting in our way a little bit.
Old 11-01-2009, 01:02 AM
  #87  
Junior Member
 
yogi98's Avatar
 
Join Date: Oct 2009
Posts: 26
Likes: 0
Received 0 Likes on 0 Posts
C350
I can't believe I missed this thread.

Does anyone have any recent updates?
Old 11-01-2009, 03:24 AM
  #88  
Junior Member
 
c350driver's Avatar
 
Join Date: Sep 2008
Posts: 38
Likes: 0
Received 0 Likes on 0 Posts
C 350
OMG, me neither! Updates? Updates?!
Old 01-18-2010, 12:21 AM
  #89  
Junior Member
 
yogi98's Avatar
 
Join Date: Oct 2009
Posts: 26
Likes: 0
Received 0 Likes on 0 Posts
C350
Happy 2010 Everyone. Any updates?
Old 02-02-2010, 02:03 AM
  #90  
Newbie
 
maksima's Avatar
 
Join Date: Aug 2008
Posts: 5
Received 0 Likes on 0 Posts
2015 MB S550 4Matic
Originally Posted by yogi98
Happy 2010 Everyone. Any updates?
This thread seems to be abandoned for a long time. I have been closely watching it. Everything started so enthusiastic I practically dreamed about a software VIM hack.

You know what we should do. Let's all chip in $10 each and get Geohot (http://en.wikipedia.org/wiki/George_Hotz) a new W204. It shouldn't be hard to find 4000-5000 interested W204 owners, should it? He seems to be pretty good at hacking everything and would probably appreciate this offer. Being that he just hacked the "Unhackeable" PS3 that is considered to be the most secured consumer electronic device on the market to date, VIM for W204 should be a piece of cake for him.
Old 02-02-2010, 06:31 PM
  #91  
Super Member
 
Peabody's Avatar
 
Join Date: Aug 2009
Posts: 964
Likes: 0
Received 2 Likes on 2 Posts
\
I hadn't though about doing a hard drive upgrade, that might be worth the time to do. Can you rip from the memory card to the hard drive or is it just from CDs? Enabling VIM from a drive image is a shot in the dark. You would pretty much need to write an emulator for the processor, and then load the image into the emulator. Then you could code break the emulator when the VIM warning popped up, traceback in the code, find the correct line of code, and noop through it. I doubt anyone would write a COMAND emulator however because that's an insane amount of work, and since there isn't any 3rd party development for the COMAND system, there's going to be no leaked SDK.

I could hack VIM in about 15 seconds if I had an emulator, but I'm not going to put in the year of development it would take to write a working emulator. Also, George Hotz didn't hack the PS3, he exploited one layer of security using the same technique that was used to hack the Gameboy. He can't however, run so much as a "HELLO WORLD" because his exploit completely crashes the system and the PS3 has layers of security in both hardware and software while the Gameboy had only one in the software.

EDIT: Is there a guide for removing the COMAND unit?
Old 02-02-2010, 08:27 PM
  #92  
Newbie
 
maksima's Avatar
 
Join Date: Aug 2008
Posts: 5
Received 0 Likes on 0 Posts
2015 MB S550 4Matic
Originally Posted by Peabody
I hadn't though about doing a hard drive upgrade, that might be worth the time to do. Can you rip from the memory card to the hard drive or is it just from CDs? Enabling VIM from a drive image is a shot in the dark. You would pretty much need to write an emulator for the processor, and then load the image into the emulator. Then you could code break the emulator when the VIM warning popped up, traceback in the code, find the correct line of code, and noop through it. I doubt anyone would write a COMAND emulator however because that's an insane amount of work, and since there isn't any 3rd party development for the COMAND system, there's going to be no leaked SDK.

I could hack VIM in about 15 seconds if I had an emulator, but I'm not going to put in the year of development it would take to write a working emulator. Also, George Hotz didn't hack the PS3, he exploited one layer of security using the same technique that was used to hack the Gameboy. He can't however, run so much as a "HELLO WORLD" because his exploit completely crashes the system and the PS3 has layers of security in both hardware and software while the Gameboy had only one in the software.

EDIT: Is there a guide for removing the COMAND unit?
You gotta read through the whole thread. A lot of works has been already done and it is not that complicated as you make it sound. Otaku has already decrypted the hard drive for the Melco unit that is used in W204. In fact he has already wrote a patch for similar Melco units that are installed in Mitsubishis and a lot of people enjoying his work. He has probably moved on to different projects or simple doesn't have time right now to finish this, but I don't leave hope that he will or someone else will figure it out and continue his work.

And yes, maybe George Hotz did not completely write custom firmware for PS3, he did find and released the exploit which gave him read/write access to the entire system memory, and HV level access to the processor. Nobody else done this to this date. He broke one of PS3 security levels. The rest will follow. Taking into consideration his contributions to the community, his is certainly one of the planet's most prominent reverse engineers and this would be a pretty easy task for him.
Old 05-06-2010, 02:27 AM
  #93  
Junior Member
 
yogi98's Avatar
 
Join Date: Oct 2009
Posts: 26
Likes: 0
Received 0 Likes on 0 Posts
C350
anyone?
Old 05-06-2010, 05:26 AM
  #94  
Junior Member
 
Midnite's Avatar
 
Join Date: Feb 2010
Location: Belgium
Posts: 18
Likes: 0
Received 0 Likes on 0 Posts
C-Class Sport 2010
i'm willing to chip in 10$.. for sure!
Old 05-06-2010, 05:41 AM
  #95  
MBWorld Fanatic!
 
Jae Duk's Avatar
 
Join Date: Oct 2008
Location: Palos Verdes
Posts: 1,204
Likes: 0
Received 1 Like on 1 Post
'09 C63
Or call midcity to get you a plug and play device
Old 05-06-2010, 10:05 AM
  #96  
Junior Member
 
Midnite's Avatar
 
Join Date: Feb 2010
Location: Belgium
Posts: 18
Likes: 0
Received 0 Likes on 0 Posts
C-Class Sport 2010
Originally Posted by Jae Duk
Or call midcity to get you a plug and play device
Live in Belgium, kind of hard for me to call midcity..
I should check what it costs around here.. i was thinking about installing it myself, but then again.. i'm a bit afraid to damage the dashboard..

Did anyone do this installation by himself?
Old 05-07-2010, 07:18 AM
  #97  
Super Member
 
Peabody's Avatar
 
Join Date: Aug 2009
Posts: 964
Likes: 0
Received 2 Likes on 2 Posts
\
Originally Posted by mirage15
They are "automotive" grade 2.5" IDE drives. SSDs may actually be a good option if you can get them in 2.5 IDEs. I think most are SATA these days but I could be very wrong. I try to not llow hardware trends
Nothing a $7 plug adapter can't fix.

http://www.amazon.com/SYBA-PATA-SATA.../dp/B002T7W1MM
Old 05-07-2010, 10:48 AM
  #98  
MBWorld Fanatic!
 
jctevere's Avatar
 
Join Date: Sep 2009
Location: Dix Hills, New York
Posts: 2,108
Likes: 0
Received 7 Likes on 7 Posts
2012 C250 Coupe
This thread went three sheets to the wind. Its almost as if Mercedes killed off the three members who were trying to do the hack...

Somebody before mentioned that it was possible for a technician to manually remove the 5mph speed limit for the command system... Is this possible or was it just a joke?

Maybe Vic can confirm?
Old 05-07-2010, 12:04 PM
  #99  
MBWorld Fanatic!
 
Krytech's Avatar
 
Join Date: Nov 2007
Location: Phoenix, AZ
Posts: 1,423
Likes: 0
Received 0 Likes on 0 Posts
2014 Ghibli S Q4 & 2008 C350
VIM would be a cool thing I'd probably use once just to do it. However it would be nice to be able to manually enter addresses in to the GPS while driving. Sucks that even my wife can't do it while I'm driving - stupid "save us from ourselves" mentality... It would also be nice to be able to upgrade the HHD to a larger size. But in reality, I haven't even half filled my current drive - the SDHC cards are just too convenient - and you can't RIP a CD while listening to something else. It would be nice if you could copy from the memory card to the HDD directly.
Old 05-13-2010, 06:41 AM
  #100  
PREMIUM SPONSOR
 
rob13572468's Avatar
 
Join Date: Mar 2007
Location: Chicago, IL
Posts: 615
Likes: 0
Received 3 Likes on 2 Posts
ML350, Lotus Elise
Originally Posted by Peabody
You would pretty much need to write an emulator for the processor, and then load the image into the emulator. Then you could code break the emulator when the VIM warning popped up, traceback in the code, find the correct line of code, and noop through it. I doubt anyone would write a COMAND emulator however because that's an insane amount of work, and since there isn't any 3rd party development for the COMAND system, there's going to be no leaked SDK.
This is pretty close to how it needs to be done.. however rather than an emulator you use a real-time debugger that hooks into the processor and then you single step the code when the video locks out which gives you the actual location of the code you need to change...

Just a couple issues with this:

The W204 is *not* the same as the mitsubshi unit... On the W204 the firmware, settings and VIM code resides in flash... I have sitting in my lab right now a W204 command that has no nav, no music server, and most importantly no hard drive... (base W204s are available with DVD but no nav or hard drive) and the vim and settings all still exist and are changeable... Why? because they dont reside on the hard drive...

The DVD map update disc does not have the VIM code on it.. You need the telematics update disc.

If you want to be able to enter nav/voice/data while in motion you dont need to hack the command, our VIM/programmer (shameless plug) performs recoding of all the data lockouts as well so that they always allow data entry... even if the VIM module is turned off.. you can see how that works here:

http://www.youtube.com/watch?v=F6s40YpjhZo


Originally Posted by Peabody
Also, George Hotz didn't hack the PS3, he exploited one layer of security using the same technique that was used to hack the Gameboy. He can't however, run so much as a "HELLO WORLD" because his exploit completely crashes the system and the PS3 has layers of security in both hardware and software while the Gameboy had only one in the software.
The attack geohotz used is called glitching: it basically involves altering the operational conditions of the microprocessor to cause it to fault in a manner that is reproducable... the ps3 attack was a basic version of this that dropped the voltage for a very short period of time (about 10 ns) but glitching can involve raising the voltage, injecting noise, speeding or slowing the system clock, or a combination of these.. You can even perform external glitches by directing microwaves or magnetic fields at localized sections of a processor by removing the top layers and viewing it with a microscope.

The reason I know this is because a few colleagues and I perfected many of these attacks against secure smartcards 8 years ago...


Anyway, if you guys *really* want to try to attempt a software hack of the comand, Ill be glad to help and point you in the right direction and even provide some support but you are going to have to put in the work on this... A good place to start with this is for someone to pull their command and open it up and get pics of the motherboard so that we can ID the processors and memory chips...


You have already rated this thread Rating: Thread Rating: 1 votes, 5.00 average.

Quick Reply: Get VIM by doing a Hard Drive Hack



All times are GMT -4. The time now is 01:24 PM.