Honda Hack / Root: 11th Gen - Work In Progress Discoveries

[Hondaccord2024]

Hey all,
I am still learning more about the civic world since getting my car last week. I was looking into something called Honda Hack that is possible on the 10th Gen Civics. I did some research and it appears the exploit worked by:

• accessing a hidden menu
• disabling android restriction
• accessing the browser and navigating to www.autohack.org/root to activate the payload to root your head unit

However, it appears the Disable Android Restriction, and quite possibly the browser apk itself is gone. One thing I did note is the new hidden menu I found allows you to activate ADB over USB, so there is a potential to just sideload a browser apk, launch it, and then try to use HondaHack or other methods to root the very outdated Android 8.1.0 OS.

This thread is just a catalog for what I discover on my quest to root / hack the new 11th gen head unit. In following posts I will post some screenshots / videos I took of the new menus and options that I found

The original Honda Hack thread for a 2017 Civic can be found on the XDA Developer forums.

What’s the developer password password?

Sponsored

 

[Integra23]

What do you mean it’s asking for a password or do I just hit OK?I’m confused.

I have never seen a password request. The 9" does not request this and simply unlocks. We still can't side load apps.

 

[Hondaccord2024]

I have never seen a password request. The 9" does not request this and simply unlocks. We still can't side load apps.

There’s no way to mod the dash to work more better with maps for CarPlay or add Netflix

 

[Hondaccord2024]

I'm so waiting for this.... it was awesome in my 10th gen! I need this again!

Did you figure this out?

 

[Integra23]

There’s no way to mod the dash to work more better with maps for CarPlay or add Netflix

More better isn't available yet. Hondahack previous method required using the internal web browser. This has been removed on the 11th gen. You are also unable to side load apps over adb since the device authorization pop-up doesn't show.

 

[17SIYoDood]

If you want a factory-like upgrade. It’s all PnP and this headunit was developed in Australia. It’s a beautiful OS also. I’ve been using this company on all of my vehicles.

https://www.teyes.com.au/

 

[Integra23]

If you want a factory-like upgrade. It’s all PnP and this headunit was developed in Australia. It’s a beautiful OS also. I’ve been using this company on all of my vehicles.

https://www.teyes.com.au/

I don't think this will work on the cars with the 9" display. These have the vehicle settings and customization screens.

 

[KeglerKing]

Watching…

 

[cwtechshiz]

Hello, been following the thread for a little while. Great work so far guys. Lots of awesome info!

Has anyone thought about investigating the hardware more? Some Mediatek chips I've ran into have a physical security screw that enables/disables write protection and debugging. Haven't seen this on any Snapdragons but this isn't exactly a phone we're dealing with so maybe? Also have to wonder if there's any kind of debug port or way to dump the contents of the storage.

As for the ADB authorization and vendor keys thing... I believe starting with kitkat, vendors public keys are installed at build time in "/adb_keys" and User-installed keys are stored in "/data/misc/adb/adb_keys".

If we can take our computer side adb client key (C:Users/$Name/.android/adbkey.pub or ~/.android/adbkey.pub) and add it to the user installed keys on the device, after a reboot you will have adb authorization just like if you were to click always allow on the USB debugging message that is not coming up. Alternatively if we can just read the vendor keys we can set the ADB_VENDOR_KEYS environment variable on the pc side and bypass user auth.


ADB over wifi wasn't a thing until android 11 for the guy that was digging deep into exploits and reaching out to reddit and xda about hacking andriod 8.1. Curious if the other guy that found the web url in the settings and mentioned spoofing the dns for it got anywhere with that? I like the thoughts and will test that dns theory if anyone can find where a web page does load and hasn't tried it yet.

Has anyone turned on OEM unlocking to see if its actually permitted? If we can get into the bootloader and its actually unlocked maybe we can boot into TWRP and start some real work from there.

Sorry for editing this like 7 times anyway ? Leaving the extra reply.

 

[cwtechshiz]

Sorry for the double post but didn't want to edit to add on to my idea.

Maybe the guy that's been trying all the button combinations can chime in on this,
Most Android devices have a button combination to get into the bootloader or recovery (or download mode on Samsung devices). I attempted holding Home+power+seek left/right combos right after pushing reboot system in one of the menus with no luck but it's a thought for anyone who wants to keep trying.

Alternatively, back to the hardware investigation kinda, some devices have a small reset button on the board or even need pins shorted out to trigger recovery mode. Below is an example I found on how to get a generic Android head unit into recovery mode.

Use the tweezers put on place C17 IC (two pin) like in picture attached, make it short circuit until the android unit restart (about 5-7 seconds) and take off the tweezers. It should restart into recovery

Again, these are just ideas. I'm really interested in helping and have a lot of nerdy experience but not willing to take apart my brand new 24 Civic or buy one of these infotainment boxes used for 300-500 to tear down and find out.

 

[madmax80]

Hello,
I haven't read all posts but I have one question: is it possible to install Android apk's on the Civic XI?
I have the option enabled, and when accesed it's looking for apk's but is not installing them.
Thanks.

 

[Stocki011]

In Europe we also have this annoying speed limit reminder using traffic sign recognition. I can turn off traffic sign recognition, but after every restart it turns on again. EU regulation, they said.
I hope someone can figure out how to hack this.

I think, Duca, you might have the same problem?

Greetings from a fresh first time Honda Owner
also very new to Forum-Culture in general

Anyway, in my few days of owning an FL5 Type R the above mentioned speed limit reminder (EU-Term: Intelligent Speed Assistent / ISA) has proven to be very irritating almost all the time.

Seems to be a new 2024 'Feature' in the EU.
How does this work for you guys in the US/CAN?

Looking forward to a possible solution for this specific problem.
?

 

[Stocki011]

I think you can only adjust the range for when it flashes. For some reason mines constantly being triggered. ?

Have you found a menu to adjust this tolerance?
Other manufacturers (Mazda, VW) seem to have such menus
?

 

[madmax80]

Yes, they have such menus because they don't have "Honda Sensing" department. For them, the purpose is "safety first" no matter what...

 

[Integra23]

Have you found a menu to adjust this tolerance?
Other manufacturers (Mazda, VW) seem to have such menus

It's either on the headunit or the cluster. I adjusted mine at one time but I think it's capped at +10 or +15 mph.

Sponsored