Dealer Mode
#1
Thread Starter
MBWorld Fanatic!
Joined: Nov 2008
Posts: 1,624
Likes: 107
From: SoCal
2018 AMG GTR, 2017 GLS63, 2019 C63s
Popular Reply
09-12-2016, 01:01 AM
Ok, so, Engineering Mode does exist on the W205's NTG5*2 as has been mentioned on various online forums/sources. And it IS disabled at the factory, by default.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
#5
Holy **** cyberoth... how did you ever find this.
I've been poking at the Head Unit / KOM / PASS etc firmware for a bit, but haven't been able to get live info until today.
I wouldn't exactly say there's "very little use" here, in fact quite a lot of good stuff if you do export some internal tracing logs...you can move around some very interesting Head Unit data/logs to USB drive for investigation.
Here's just a sample of what you can see from a coredump (edited to remove my info)
Above is an example of an HTTP connection sent from the HU. When online our cars make a VPN connection if you use the COMAND browser and all data flows through there. Data used to go through Germany, now goes to Mexico (at least in my case). If you use another computer and connect to in-car WiFi, the connection goes straight over Verizon's network.
I've caught stuff like this before via packet sniffing but this is good to see from logs as well. Anyway theres a lot more interesting stuff here..
I have no idea where all this data is from (well, the Head Unit duh) but there is soooooooo much stuff to look through. Logs, traces, coredumps and libraries from QNX. I don't think I'd be able to do this in my wildest CAN-sniffing dreams.
Thank you, I will not be sleeping tonight while I sift through every bit of data here.
I've been poking at the Head Unit / KOM / PASS etc firmware for a bit, but haven't been able to get live info until today.
I wouldn't exactly say there's "very little use" here, in fact quite a lot of good stuff if you do export some internal tracing logs...you can move around some very interesting Head Unit data/logs to USB drive for investigation.
Here's just a sample of what you can see from a coredump (edited to remove my info)
GET http://serv5.dvb.corpinter.net/favicon.ico HTTP/1.1
Host: serv5.dvb.corpinter.net
Accept: */*
Accept-Encoding: deflate, gzip
Proxy-Connection: Keep-Alive
accept-language: en
cookie: daivb_envprefix_AM=gen2prod; daivb_vin=55SWF<MY VIN>
connection: keep-alive
accept-charset: utf-8
X-DAG-Data: 205, Front, High, 9.1
User-Agent: Mozilla/5.0 (DAG; 2.2; like Gecko) AppleWebkit/535.17
Referer: http://serv5.dvb.corpinter.net/web5sop/mainmenuservice/checkTosAndGetServiceList.html?vin=<MY VIN>&market=AMERICA&distanceunit=MILES&temperature unit=F&timezone=GMT-8:00&datetimeformat=MM/DD/YYYY,HH:MM%20(AM/PM)&huversion=DAG.1.4.0&console=ROW1_DRIVER&langua ge=US&locale=en_US&design=0&isDwt=false&resetrequi red=false&dirUrl=%2Fmbfipradio%2Fipradio.html%3Fvi n%3D<MY VIN>%26timeStamp%3D237%26delivered%3DOK%26pagevers ion%3D1
Host: serv5.dvb.corpinter.net
Accept: */*
Accept-Encoding: deflate, gzip
Proxy-Connection: Keep-Alive
accept-language: en
cookie: daivb_envprefix_AM=gen2prod; daivb_vin=55SWF<MY VIN>
connection: keep-alive
accept-charset: utf-8
X-DAG-Data: 205, Front, High, 9.1
User-Agent: Mozilla/5.0 (DAG; 2.2; like Gecko) AppleWebkit/535.17
Referer: http://serv5.dvb.corpinter.net/web5sop/mainmenuservice/checkTosAndGetServiceList.html?vin=<MY VIN>&market=AMERICA&distanceunit=MILES&temperature unit=F&timezone=GMT-8:00&datetimeformat=MM/DD/YYYY,HH:MM%20(AM/PM)&huversion=DAG.1.4.0&console=ROW1_DRIVER&langua ge=US&locale=en_US&design=0&isDwt=false&resetrequi red=false&dirUrl=%2Fmbfipradio%2Fipradio.html%3Fvi n%3D<MY VIN>%26timeStamp%3D237%26delivered%3DOK%26pagevers ion%3D1
I've caught stuff like this before via packet sniffing but this is good to see from logs as well. Anyway theres a lot more interesting stuff here..
I have no idea where all this data is from (well, the Head Unit duh) but there is soooooooo much stuff to look through. Logs, traces, coredumps and libraries from QNX. I don't think I'd be able to do this in my wildest CAN-sniffing dreams.
Thank you, I will not be sleeping tonight while I sift through every bit of data here.
The following users liked this post:
alvib23 (01-01-2019)
#7
I was looking around in this the other day and say the option for Drive mode. something about learning. ill take a picture. i also saw soemthing about auto start stop and was hoping it would disable it but it didnt
Trending Topics
#8
Thread Starter
MBWorld Fanatic!
Joined: Nov 2008
Posts: 1,624
Likes: 107
From: SoCal
2018 AMG GTR, 2017 GLS63, 2019 C63s
Holy **** cyberoth... how did you ever find this.
I've been poking at the Head Unit / KOM / PASS etc firmware for a bit, but haven't been able to get live info until today.
I wouldn't exactly say there's "very little use" here, in fact quite a lot of good stuff if you do export some internal tracing logs...you can move around some very interesting Head Unit data/logs to USB drive for investigation.
Here's just a sample of what you can see from a coredump (edited to remove my info)
Above is an example of an HTTP connection sent from the HU. When online our cars make a VPN connection if you use the COMAND browser and all data flows through there. Data used to go through Germany, now goes to Mexico (at least in my case). If you use another computer and connect to in-car WiFi, the connection goes straight over Verizon's network.
I've caught stuff like this before via packet sniffing but this is good to see from logs as well. Anyway theres a lot more interesting stuff here..
I have no idea where all this data is from (well, the Head Unit duh) but there is soooooooo much stuff to look through. Logs, traces, coredumps and libraries from QNX. I don't think I'd be able to do this in my wildest CAN-sniffing dreams.
Thank you, I will not be sleeping tonight while I sift through every bit of data here.
I've been poking at the Head Unit / KOM / PASS etc firmware for a bit, but haven't been able to get live info until today.
I wouldn't exactly say there's "very little use" here, in fact quite a lot of good stuff if you do export some internal tracing logs...you can move around some very interesting Head Unit data/logs to USB drive for investigation.
Here's just a sample of what you can see from a coredump (edited to remove my info)
Above is an example of an HTTP connection sent from the HU. When online our cars make a VPN connection if you use the COMAND browser and all data flows through there. Data used to go through Germany, now goes to Mexico (at least in my case). If you use another computer and connect to in-car WiFi, the connection goes straight over Verizon's network.
I've caught stuff like this before via packet sniffing but this is good to see from logs as well. Anyway theres a lot more interesting stuff here..
I have no idea where all this data is from (well, the Head Unit duh) but there is soooooooo much stuff to look through. Logs, traces, coredumps and libraries from QNX. I don't think I'd be able to do this in my wildest CAN-sniffing dreams.
Thank you, I will not be sleeping tonight while I sift through every bit of data here.
#9
Ok so I've been digging through this stuff (Core dumps, "Emergency Log" trace files) for a while... I'll have a long writeup soon but here's some teasers.
I had a friend show me the DVD in Motion "hack" and its files. I took apart their code and while going back and forth with the trace logs realized how it works and how I can load my own code and then have it run on the NTG5's QNX OS.
So I wrote a QNX library in C which (for the sake of quicker testing) launches a shell (ksh to be exact) on the Head Unit which runs a shell script on my SD card which calls an internal program called Splash (guess what it does...) which loads and displays a file from my SD card. Thats all it does for now... here's what it looks like:
https://www.dropbox.com/s/1ymwdsx98c...03759.mp4?dl=0
Nothing exciting, but I learned quite a bit about how the HU works and all the behind the scenes stuff. Still lots more to do.
Regarding "Engineering Mode/Menu"... there are hints but I still haven't figured out how to launch it either... here's some strings from a file named "engineering.cfg" on the HU's file system:
There's a few similar entries to what we see in the Dealer Menu, but a lot of stuff that we don't (such as Variant Coding over file... which is really how the DVD in Motion thing is done btw).
I'm going to keep digging and let you know how it goes.
I had a friend show me the DVD in Motion "hack" and its files. I took apart their code and while going back and forth with the trace logs realized how it works and how I can load my own code and then have it run on the NTG5's QNX OS.
So I wrote a QNX library in C which (for the sake of quicker testing) launches a shell (ksh to be exact) on the Head Unit which runs a shell script on my SD card which calls an internal program called Splash (guess what it does...) which loads and displays a file from my SD card. Thats all it does for now... here's what it looks like:
https://www.dropbox.com/s/1ymwdsx98c...03759.mp4?dl=0
Nothing exciting, but I learned quite a bit about how the HU works and all the behind the scenes stuff. Still lots more to do.
Regarding "Engineering Mode/Menu"... there are hints but I still haven't figured out how to launch it either... here's some strings from a file named "engineering.cfg" on the HU's file system:
Code:
cat engineering.cfg <?xml version="1.0" encoding="ISO-8859-1"?> <config> <tree name="HBAS"> <menu path="Car"> <op-move path="/CAR"/> <menu path="Kleer"> <menu path="Pairing"> <op-remove/> </menu> </menu> </menu> <menu path="System"> <op-move path="/SYS"/> </menu> <menu path="OnOff"> <op-move path="/SYS/OnOff"/> </menu> <menu path="Variant Coding over File"> <op-move path="/SYS/Variant Coding over File"/> </menu> <menu path="Variant Code"> <op-move path="/SYS/Variant Code"/> </menu> <menu path="pathology"> <op-move path="/SYS/Pathology"/> <menu path="SoftwareDL"> <op-move path="/SYS/SWDL"/> </menu> <menu path="SWDL"> <op-remove/> </menu> </menu> <menu path="sys"> <op-remove/> <menu path="env"> <!-- responsible: Platform --> <op-move path="/SYS/Environment"/> </menu> <menu path="most"> <!-- responsible: Platform --> <op-move path="/SYS/Environment/MOST"/> </menu> <menu path="media"> <!-- responsible: Platform --> <op-move path="/SYS/Environment/Media"/> </menu> <menu path="errormem"> <!-- responsible: Platform --> <op-move path="/SYS/Environment/Error Memory"/> </menu> </menu> <menu path="Instrument-Cluster"> <op-move path="/HMI/Instrument-Cluster"/> </menu> <menu path="CAN"> <op-move path="/SYS/Environment/CAN"/> </menu> <menu path="Speech & Conn."> <op-move path="/SCP"/> </menu> <menu path="navi"> <op-move path="/Navi"/> <menu path="demomode"> <op-remove/> </menu> <menu path="freshmap update"> <op-remove/> </menu> <menu path="dealer database"> <op-remove/> </menu> </menu> <menu path="mm"> <op-move path="/MM"/> </menu> </tree> <tree name="Customer"> <menu path="navi"> <menu path="database"> <op-remove/> </menu> <menu path="assertionlog"> <op-remove/> </menu> <menu path="destmemory"> <op-remove/> </menu> <menu path="defaultcountry"> <op-remove/> </menu> <menu path="sensor"> <op-remove/> </menu> <menu path="tmc"> <op-remove/> </menu> <menu path="settings"> <op-remove/> </menu> <menu path="audio"> <op-remove/> </menu> <menu path="tracing"> <op-remove/> </menu> <menu path="weather"> <op-remove/> </menu> <menu path="test ic"> <op-remove/> </menu> <menu path="navi replay"> <op-remove/> </menu> <menu path="system info"> <op-remove/> </menu> <menu path="automatic blockage"> <op-remove/> </menu> <menu path="speech test"> <op-remove/> </menu> <menu path="mounting position hu"> <op-remove/> </menu> <menu path="error history"> <op-remove/> </menu> </menu> <menu path="mm"> <op-remove/> </menu> <menu path="Car"> <menu path="FavKey"> <op-remove/> </menu> <menu path="Touchpad"> <op-remove/> </menu> <menu path="Variant Coding backup"> <op-remove/> </menu> <menu path="Favourite"> <op-remove/> </menu> <menu path="EnergyFlow"> <op-remove/> </menu> <menu path="Climate test"> <op-remove/> </menu> <menu path="Distraction"> <op-remove/> </menu> <menu path="Vehicle test"> <op-remove/> </menu> <menu path="MFS mode"> <op-remove/> </menu> <menu path="CIS"> <op-remove/> </menu> <menu path="EMC mode"> <op-remove/> </menu> <menu path="Time"> <op-remove/> </menu> <menu path="Comm System Settings"> <op-remove/> </menu> <menu path="DiBA"> <op-remove/> </menu> <menu path="DiBA_StartPage"> <op-remove/> </menu> <menu path="EMC HB"> <op-remove/> </menu> <menu path="Kleer"> <menu path="ENG"> <op-remove/> </menu> </menu> </menu> <menu path="System"> <op-remove/> <menu path="System Info"> <op-move path="/Sys/System Info"/> </menu> </menu> <menu path="AVT"> <menu path="audio"> <menu path="chimes"> <op-remove/> </menu> <menu path="TLAM"> <op-remove/> </menu> <menu path="Reset Factory Settings"> <op-remove/> </menu> </menu> <menu path="tuner"> <op-remove/> </menu> <menu path="video"> <op-remove/> </menu> </menu> <menu path="sys"> <op-remove/> </menu> <menu path="pathology"> <op-move path="/Sys"/> <menu path="Label"> <op-remove/> </menu> <menu path="SWDL"> <op-move path="/Sys/SWDL"/> </menu> <menu path="SoftwareDL"> <op-remove/> </menu> <menu path="Trace"> <op-remove/> <menu path="Emergency Error Log"> <op-move path="/Sys/Emergency Error Log"/> </menu> <menu path="Trigger"> <op-remove/> <menu path="Clear"> <op-remove/> </menu> <menu path="Allow CAN Trigger"> <op-move path="/Sys/Allow CAN Trigger"/> </menu> <menu path="Export"> <op-move path="/Sys/Export Trigger"/> </menu> </menu> </menu> </menu> <menu path="MM"> <op-remove/> </menu> <menu path="CAN"> <op-remove/> </menu> <menu path="Variant Code"> <op-remove/> </menu> <menu path="Speech & Conn."> <op-remove/> </menu> <menu path="Instrument-Cluster"> <op-remove/> </menu> <menu path="Variant Coding over File"> <op-remove/> </menu> <menu path="HMI"> <op-remove/> </menu> </tree>
I'm going to keep digging and let you know how it goes.
The following 9 users liked this post by mozy:
AlexZTuned (08-23-2016),
asaddd (08-07-2021),
cocoh (04-10-2017),
cyberorth (08-22-2016),
Davesc63 (08-24-2016),
and 4 others liked this post.
#14
Ok, so, Engineering Mode does exist on the W205's NTG5*2 as has been mentioned on various online forums/sources. And it IS disabled at the factory, by default.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
The following 11 users liked this post by mozy:
Chris Estes (09-13-2016),
cocoh (02-07-2018),
cyberorth (09-13-2016),
Davesc63 (09-12-2016),
diggs718 (07-20-2022),
and 6 others liked this post.
The following users liked this post:
Wexlax732 (02-08-2020)
#19
Ok, so, Engineering Mode does exist on the W205's NTG5*2 as has been mentioned on various online forums/sources. And it IS disabled at the factory, by default.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
W205 Engineering Mode - YouTube
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
Normally, the only way you can enable it is via a dealer service tool.
Here's what it looks like:
W205 Engineering Mode - YouTube
I spent about a month poking around the HU, then about a week figuring out how to enable EM.
Then I spent two weeks sitting on this info deciding whether or not its a good idea to release it.
I've compiled my notes on how I figured this stuff out and how it _can_ be done, but not a step-by-step guide on turning on EngMode.
I'm giving you the bullets but you're going to have to pull the trigger and shoot yourself in the foot.
There is no easy/safe way to do this for most people, which is why I'm only providing details and not instructions.
So here's the notes I've made: HURRDURR
I wasn't sure if I should have even posted this because I'm sure there will be whining/outcry to just "do it for us".
Call me an a$$hole or whatever, I don't care. I can't give you a simple plug-and-play solution here, sorry.
Start a "go fund me" for more R&D!
Or maybe contact some tune companies see if they want to maybe pitch in for your insight!
#21
So I've made myself a ticket to the dance!
Still need to explore the options and see what can be done but there's a few teasers... Distraction / Distraction_ECE_USA_CHN and various hex-based switches
As Mozy mention, It's not easy! His write up was a good push in the right direction but a lot of gaps needed to be filled. I wouldn't call what I've done perfect - But it achieves the end result!
I didn't have access to any of the DVD In Motion / VIM files, which would have been a massive help... So if anyone would like to share their files with me I'd greatly appreciate it!
Still need to explore the options and see what can be done but there's a few teasers... Distraction / Distraction_ECE_USA_CHN and various hex-based switches
As Mozy mention, It's not easy! His write up was a good push in the right direction but a lot of gaps needed to be filled. I wouldn't call what I've done perfect - But it achieves the end result!
I didn't have access to any of the DVD In Motion / VIM files, which would have been a massive help... So if anyone would like to share their files with me I'd greatly appreciate it!
#22
Hmm, I guess my guide wasn't vague and misleading enough... haha JK good job. Glad to see a kindred spirit. The gaps in info are on purpose as stated before, both as a safety-net and a challenge. Looks like you did just fine.
There's really nothing else interesting in the DiM files (at least to me), I _believe_ the actual process of making the coding changes to remove Distraction stuff is encrypted/obfuscated and I don't care to debug QNX programs. I found my entry-point into the system and moved on from there, wiped those files as I have no more use for them. EngMode was just a challenge to see if I can do it, not the ultimate goal in my case.
Have fun, and dont fsck **** up.
There's really nothing else interesting in the DiM files (at least to me), I _believe_ the actual process of making the coding changes to remove Distraction stuff is encrypted/obfuscated and I don't care to debug QNX programs. I found my entry-point into the system and moved on from there, wiped those files as I have no more use for them. EngMode was just a challenge to see if I can do it, not the ultimate goal in my case.
Have fun, and dont fsck **** up.
#23
So I've made myself a ticket to the dance!
Still need to explore the options and see what can be done but there's a few teasers... Distraction / Distraction_ECE_USA_CHN and various hex-based switches
As Mozy mention, It's not easy! His write up was a good push in the right direction but a lot of gaps needed to be filled. I wouldn't call what I've done perfect - But it achieves the end result!
I didn't have access to any of the DVD In Motion / VIM files, which would have been a massive help... So if anyone would like to share their files with me I'd greatly appreciate it!
Still need to explore the options and see what can be done but there's a few teasers... Distraction / Distraction_ECE_USA_CHN and various hex-based switches
As Mozy mention, It's not easy! His write up was a good push in the right direction but a lot of gaps needed to be filled. I wouldn't call what I've done perfect - But it achieves the end result!
I didn't have access to any of the DVD In Motion / VIM files, which would have been a massive help... So if anyone would like to share their files with me I'd greatly appreciate it!
#24
Hmm, I guess my guide wasn't vague and misleading enough... haha JK good job. Glad to see a kindred spirit. The gaps in info are on purpose as stated before, both as a safety-net and a challenge. Looks like you did just fine.
There's really nothing else interesting in the DiM files (at least to me), I _believe_ the actual process of making the coding changes to remove Distraction stuff is encrypted/obfuscated and I don't care to debug QNX programs. I found my entry-point into the system and moved on from there, wiped those files as I have no more use for them. EngMode was just a challenge to see if I can do it, not the ultimate goal in my case.
Have fun, and dont fsck **** up.
There's really nothing else interesting in the DiM files (at least to me), I _believe_ the actual process of making the coding changes to remove Distraction stuff is encrypted/obfuscated and I don't care to debug QNX programs. I found my entry-point into the system and moved on from there, wiped those files as I have no more use for them. EngMode was just a challenge to see if I can do it, not the ultimate goal in my case.
Have fun, and dont fsck **** up.
I still have challenges with library paths -- splash / dispmsg / netstat... some binaries won't run due to missing lib* but didn't stop me getting EngMode...
I think the biggest challenge was obtaining QNX SDP. I compiled a basic C program and struggled with 'Library not found' but once I compiled under QNX it cleared things up and suddenly I was in shell execution land.
If someone has the DVD in Motion files they are willing to share, I would barter it for the files to unlock engineering mode. I really want to look at the "professional" hack files to learn more about what they are doing!