Author: editor

Around the Bay Area the kind of businesses that use the internet are broad and diverse, but some common architecture is evident at most sites with less than 20 employees. Comcast high speed business cable internet is dominating the market in the Berkeley area, with AT&T coming in close with xdsl in areas Comcast can’t serve well. A few customers are using mobile broadband and tethering phones and tablets with data to sync their computers. Frequently seen is a naked LAN behind the stock SMC modem provided to business customers. On default settings the modem responds to pings from WAN, has the default user name and password, and while it has a token firewall, it has no IP filtering or intelligence and the firewall is there to forward ports more than anything. However uncommon, it is very important to put even an entry level VPN firewall in place to provide secure tunneling, countersurveillance, and denial of service protection. From the modem to the firewall, and then to the switch where the work of the LAN is done, files are shared, printers tasked, and internal work is being prepared for its debut. Bandwidth varies with usage, but at 35 down and 15 up there are enough megabits for everyone. Credit card processing machines are often run on the fax phone line which costs an additional 30/mo. on top of the internet (~120), web hosting (~30/mo), domain (~30/yr), and IT service (~150/mo), but can be run over the net with the use of the firewall to protect its already encrypted communication. The fax machine is replaced with a networked all in one printer/scanner/copier and sometimes the fax remains but is usually made obsolete by the scanner and pdf documents. Aside from a spam and ip filter little else is necessary for a SOHO network.

First things first! Do your prep work.

In my case I am rooting a Wincen Telechips 8902 that has WinCE partition and an Android 2.3 partition. The WinCE side handles the dvd/cd, ipod, rds, ATSC tuner, AM/FM tuner and aux AV inputs. The Android side handles the gps receiver, wifi, and 3g. It shares av inputs, nand and ram with the wince side, and I have to identify the right usb to establish an adb bridge.

There are 3 usb connections, with two in back to the android side and one in front to the wince side. It also has teo sd card slots, one for wince side, and one for android side. In normal operation, the wince side is for firmware updates and music, and the android side is for maps.

Taking a hint from the pocketables guide, I am rooting my unit using so I can dump the android rom first.

Once I have it rooted I am using romdump to make a dump of the android side.

After creating a recovery of the android side using romdumps output, I will then use wince tricks to dump the wince side and make a recovery of it as well.

The most popular brand of embedded systems for the E46 series BMWs is the Dynavin. They make a WinCE 6 and an Android 2.3 version. The WinCE 5 version is discontinued, and the WinCE6 version comes with or without android on a separate partition. I’ve put together a complete Dynavin support library, with multiple versions of igo and other apps for wince and android, and I am tired of the BS. I need a universal ROM and a deployment script to figure out each system’s maximum capabilities and deploy itself to spec for the board its writing to.

The Dynavin is available from http://jandtdistributing.com/dynavinsolutions/bmw-stereo-navigation-units-and-accessories/dynavin-e46-d99-android/ for 799, and http://www.dynavinstore.com/shop/bmw-series/dynavin-dvn-e46-d99.html for 990.17 not including the backup camera, 3G dongle, wifi dongle, hdtv tuner, hd radio tuner, ac relocation kit or SH. So yeah, if you want an all in one unit and dont want to develop anything or pwn your car, then just go there and blow money on that.

Not all of us bought our BMWs new, and we don’t have a small fortune to spend on a little embedded computer. Fewer of us still, like myself, are willing to pay for a computer, but will not buy one without having root, the full functionality expected or exploitable from it, and the look of OEM as well. There is now a huge market for Dynavin clones which provide similar function, although the performance and quality of the clones compared to the original Dynavin are inferior. I have a clone which came with all the extras and am still dissatisfied. However, all these units come from China and thus cannot be economically returned.

I have been through a D95 unit, and a D99+Android clone, and I am very dissatisfied. I eventually want to put together a library so a single rom can be flashed to the myriad boards which roots the box, backs up everything to sd card, unmounts sd card, loads packages, builds, and flashes the generic rom over with the self customized rom, and runs real time. These boards, embedded in these aftermarket stereo systems, can all run the same RTOS, android or not, and I will make the SD prep tool and common image available publicly, so like a liveCD, every aftermarket navigation radio can boot. From the live boot, the script will build a rom customized to the chips capabilities, rooting it, deploying busybox and botbrew, and installing whatever other packages are appropriate for the chip.

The biggest problems are canbus/ibus communication with the steering wheel and radio buttons, the uninterruptible power supply, and wiring the HDTV and Backup video into the video and HD Radio tuners into the audio. The GPS, DVD, and USB units are all onboard most of these units, but what varies most among them all is the board used and the FAKRA/canbus connection. Until all the boards are documented, the best workaround will be tapping the canbus and using one of the usb canbus adapters with linux libraries like bus pirate or stk500.