r/CarHacking • u/mvespermann • 2d ago
Original Project CarPlay box reverse reverse engineering/software mod
Hello folks!
I’ve already made several posts in this subreddit about my attempts to reverse-engineer a CarPlay/MMI box installed in my father’s car. My ultimate goal is to obtain a copy of its OS/firmware so I can modify it to suit my needs, experiment with it, and hopefully improve its functionality.
The biggest obstacle so far has been getting access to the firmware itself.
I’ve already attempted to gain UART access to the box but haven’t succeeded, although I’ve made some decent progress with the hardware reverse engineering. I also tried using Allwinner FEL mode, since the board is Allwinner-based, but that didn’t work either. If you’re interested in the hardware side of things, check out my previous posts: [this post] and [this post].
However, what I’m really interested in is the software, and I’m struggling to make progress there.
My original plan was to obtain an official firmware update file and reverse engineer it to understand how the system works. Unfortunately, the manufacturer doesn’t seem willing to provide the update file unless I can give them a specific reason for needing it. I’ve included screenshots of our conversation below.
This time, I contacted them directly, using my main email address and without making up an excuse for requesting the firmware. I’m currently waiting for their response, so hopefully that approach works.
In one of my previous posts, someone mentioned that they had managed to obtain an update file for a different MMI box and successfully modify its OS. That seems like it could be the easiest way forward, but so far as I just said, the manufacturer haven't been willing to help me.
Does anyone have any suggestions for how I could approach this?
One idea I had was to create a specially prepared USB flash drive that takes advantage of the MMI box’s built-in USB firmware update mechanism. Ideally, I’d like to find a way to get the system to execute some code that would allow me to dump its existing firmware onto the flash drive. Is something like that technically feasible, assuming the update mechanism has a vulnerability or accepts insufficiently verified update packages? If so, what would be a good starting point for investigating it?
I’m also open to other approaches, whether that’s finding a way to access the bootloader, extracting the firmware directly from the storage chip, finding compatible firmware from another device, or discovering a way to retrieve the official update package. Although I want to try the non invasive ways first, such as obtaining the update file and maybe making a usb stick exploit.
For reference, my device is an ANYFAR RM BM2506F, an aftermarket BMW MMI/CarPlay interface running a Linux-based operating system. It uses an Allwinner-based board, and I have already done some hardware investigation.
Here is the software information displayed in the box’s settings:
- Software: Box-C212 V2.6.3.0821
- Hardware: B2411-02-000d-0a-00-00-00
- System: Linux 5.4.61 (2025-07-24)
- Bluetooth: ZA_STD_BT01 V2.8.6 (2025-07-23)
- MCU: V5.1.8_202598 (0x02, 0x00)
I’d really appreciate any ideas, technical suggestions, or pointers toward resources that could help me make progress. I’m doing this primarily as a personal reverse-engineering project, because I’d love to understand how this device works and eventually customize its software.
Thanks in advance!
2
u/burny110 2d ago
This looks like a white labelled Lincet box...the fireware has been posted to a few forums. I have a copy of the update file which includes the firmware for my variant of the box if you want a poke
1
u/mvespermann 1d ago
Does it match the software infos that are on mine?
1
u/burny110 1d ago
It doesn't match the build number but I'll send it to you anyway when I'm home. Might help you unpick this thing.
1
1
1
u/heuering 2d ago
I'm not sure if it's of any help, but I have a Mr12Volt MMI box in my 2011 530d with CIC iDrive and that settings interface is identical. They have some updates which you may be able to reverse on their website.
https://www.mr12volt.com/en-gb/pages/p2000-series-software-updates
1
u/mvespermann 2d ago
Can you post a picture of the home screen of your MMI interface?
1
u/heuering 2d ago
Not my pic but it's the same as this https://i.ibb.co/2Nm5ZYF/0800-D409-56-A5-485-A-A3-E3-18-A06370-D950.jpg
1
u/rusefi 2d ago
Please post images of the PCB
2
u/mvespermann 2d ago
All the images in here, i digitalized the disassembled board in HIGH res in this folder:
https://drive.google.com/drive/folders/10PBeouz-TuzcHv79kWYkvnckq6mIc1B5
1
u/Dry_Vanilla_114 2d ago
En mi placa carpod Go t3 no tiene serigrafía del GND RTX y TX y use 2 pinzas SDK 08 Y consegui leer por UART.
1
u/Professional-Mall323 2d ago
Question, does yours stay on, connected and playing after you get out of the car? Like does your podcast/music/youtube not stop when you turn off the car?
I’m about to throw mine through Claude
Sazy Auto has the worst rude gaslighting customer service. They can suck it. Orange box is a piece of shit.
1
u/mvespermann 2d ago
My box is video only, all my audio is still going through my OEM NBT EVO Headunit, I have never faced any issues whatsoever. The only remotely similar thing that happens with me is that when I get near my car, the keyless entry powers the car electrical system and also the mmi, which makes it connect to my phone thinking I will use the car, and sometimes starts randomly playing songs on my phone.
1
u/Late-Opportunity-723 15h ago
Sazy Auto aka sinairyu aka something like Limcet had online updater, you can obtain update img and do analysis and soft modifications with claude. At least sinairyu didn't have any software signing.
6
u/rusefi 2d ago
We were able to replace software in a different T113 unit, that one has UART on PCB which has helped a ton!
I believe there is a number of different brands, maybe some are easier to deal with?