Unable to rollback/upgrade to CFW

[abbottnetworks]

ref: https://forums.macrumors.com/threads/carplay-adapter-to-convert-to-wireless-carplay.2193978/post-30289650

Here's the play-by-play...
I was able to upgrade using your stock firmware repository to "Firmware/U2W_AUTOKIT_Update_2021.08.24.1817.img" (confirmed as spatial stream reduced to 1, interesting enough, throughout this entire process, the spatial streams remained "1" even after rolling back to the 2020.11.10.2139 firmware).

1631892440231.png

Per all of the online readme, I tried to use the "Firmware/U2W_Update_2020.11.10.2138_ROLLBACK.img"... No dice. Does absolutely nothing while running the "U2W_AUTOKIT_Update_2021.08.24.1817.img".

Tried your post above @VLud , "VLud said:
Try U2W_AUTOKIT_Update_2020.12.25.1732_ROLLBACK.img instead then. You can't install CFW straight away due to new encryption, nothing new."

-- This sort of works. I loaded it to the flash drive, inserted it... and no blinking red/green... however, the web interface does how the firmware version changed from 2021.08.24 to...

1631892632618.png  
That said, it did this all within maybe 5-10 seconds? No flashing, no reboot... and it also shows the update available:

1631892675817.png  

Disconnecting the USB flash drive after ~5 minutes of sitting, it did reboot.
Post-reboot, it still shows v2020.12.25.1733...
Cleaned off the flash drive and downloaded the "Firmware/U2W_Update_2020.11.10.2138_ROLLBACK.img".
This time, after about 5-10 seconds, the version changed to v2020.11.10.2139... No flashing, no reboot, etc...
I waited about 5 minutes (to give it time to finish any processing/flashing) before disconnecting the USB flash drive.
It rebooted after the flash drive was removed, and shows:

1631893160550.png  
Checking for updates does nothing at this point... No rollback option within the settings...
I tried jumping over to the custom firmware "Custom_Firmware/2021.08.24_BASED/AUTOKIT/U2W_AUTOKIT_Update.img". Does nothing, still shows the 2020.11.20 version...
Power-cycled the device and tried loading custom firmware: "Custom_Firmware/2021.04.26_BASED/AUTOKIT/U2W_AUTOKIT_Update.img"
Tried renaming it to "U2W_Update"and power-cycled the device again.
Did nothing, still shows v2020.11.10.2139...
Downloaded "Custom_Firmware/2021.03.06_BASED/AUTOKIT/U2W_AUTOKIT_Update.img"
Kept the filename as the same... (did not remove AUTOKIT).
Did nothing. Renamed to "U2W_Update.img" and again no dice.
This time I thought I'd try doing the latest file again, including the two script files...
Downloaded: "Custom_Firmware/2021.08.24_BASED/AUTOKIT/U2W_AUTOKIT_Update.img"
as well as the two script files:
"Custom_Firmware/Scripts/Downgrade_2021.03.06/ARMimg_maker"
"Custom_Firmware/Scripts/Downgrade_2021.03.06/U2W.sh"
placed all three files on the root of the flash drive... and no luck, no change. Power-cycled the device and still nothing.

I'm a bit out of steps to try. I'm open to testing more if anyone has any input... but I cannot get it to switch over to the custom firmware. Maybe I am missing something (hopefully not obvious)?

I tried to keep it on the OEM firmware, but update again to something later... and now it appears to be stuck on the 2020.11.10 version. It won't take any of the newer auto kit files within /Firmware/ and the OTA update appears to be broken. hahaha <curse word/> -- I'll update if I figure out how to shake it loose.

Rebooting with the USB flash drive inserted, w/ the 2020.12.25.1732_rollback image resolved the issue (oddly enough, seems to have remembered the TOYOTAEB SSID as well, no more AUTOBOX wifi). It's now running that version... Spatial Streams still show "1" instead of "2"... Once the interface showed the newer version, I unplugged the flash drive and it rebooted. Performed OTA update to 2021.03.06.1356 (no typo).... It did its thing and rebooted by itself. It's now running version 2021.03.06.1355 post-reboot... Spatial streams are now showing "2".

I'm planning on keeping it at the 2021.03.06.1355, rollback shows 2020.12.25.1732... unless it's not stable in my truck. Then I'll plan on updating it to something later. Time to go mess with the Podofo...

** all of these tests were performed outside of my car, with the Carlinkit connected to my MBP PD Apple charger.

I am unable to install any Custom Firmware on my v3.0 Carlinkit (Broadcom Chip, confirmed Wireless 5/AC 80Mhz). I'm open to feedback or to help test.
I believe the play-by-play I provided is detailed enough. If you need more information or clarification, please let me know!

Thank you!

[dmavromatis]

I also have reported the same exact issue:

#110

and

#111

@ludwig-v let me know if you need any more data from us.

Thanks!

[jailbird777]

I might have the same (or similar) issue. 3.0 CarlinkIT from a few months ago was running custom and I bricked it trying to upgrade it somehow. I'm trying to find my SOIC-8 clips to revive it, but I figured I could use a spare anyways, so I ordered another one. They were backordered and it just came in, I believe it came with 2021.07.05.2319 on it (at least that's what is listed as the rollback option, I hadn't even used it before I tried customizing it).

I couldn't get it to take either U2W_Update_2020.11.10.2138_ROLLBACK.img nor U2W_AUTOKIT_Update_2020.12.25.1732_ROLLBACK.img no matter what I named them. I'd plug the USB thumb stick into the unit when it was sitting at the red LED, and it would just flash the thumb stick for a second and that's it.

It took U2W_AUTOKIT_Update_2021.08.24.1817.img just fine, however, if I renamed it to U2W_AUTOKIT_Update.img . I'm wondering if they did something on these newer units in order to make it not downgradeable?

[dmavromatis]

@jailbird777 yes, that sounds inline with what we are experiencing with v3.0 devices.

[abbottnetworks]

That's my thought, there's something on the newer hardware that is doing a verification/check on the firmware.. I'm thinking the older firmware might be missing something, or incomparable in some way; so it's not actually flashing it... There's no way it's flashing the full file in just a few seconds... without any indication; just the web GUI being updated with a new string.

[dmavromatis]

@ludwig-v any thoughts on this? Let me know if you need a V3.0 device, so you can test yourself.

[ludwig-v]

No software solutions until the new encryption is broke, as you told U2W_AUTOKIT_Update_2020.12.25.1732 is resulting in 2020.12.25.1733 on V3 devices : this is suggesting the proprietary update binary is not replacing the encryption binary by the old one (since you can install new versions right away) and change the version number

Hardware solution: directly write the flash. I can make a dump from latest CFW that would work on V3 devices (>= 2021.03.06)

[dmavromatis]

Hardware solution: directly write the flash. I can make a dump from latest CFW that would work on V3 devices (>= 2021.03.06)

@ludwig-v yes, please dump a CFW BIN I can flash directly -- ideally the CFW 2021.08.24 version.

FYI: I successfully was able to directly flash a bricked v2 unit and recovered it... so I'm ready to try to directly flash a V3.0 unit.

Update: I tried to dump V2 CFW 2021.08.24 to BIN and flash V3 unit but it didn't work... I get a "Hardware Error: Wi-Fi BT". It's running the CFW, just giving me the Wi-Fi error... Let me know if that should work or if you need to dump a special version that works on V3 devices. You can provide either a U2W.sh script that copies the correct wifi-bt drivers or a complete BIN.

[abbottnetworks]

If there's anything I can do to help, let me know. I'd be happy to test the hardware solution as well, that said I'm not sure what is involved with writing directly to the flash. Anything special with that process?

[dmavromatis]

It's actually fairly straight forward... just order a CH341 programmer ($11 on Amazon) and ASProgrammer (using 1.4.1) and you clip the programmer on the chip and read/write the BIN files (see: #72). I recovered a V2... which was awesome.

Now, just trying to get the CFW directly flashed on the V3, but it looks like just dumping a working CFW on a V2 isn't enough... since the V2 is using the RTL drivers and not the BCM.

So I think @ludwig-v needs to create a V3 compatible BIN for direct flashing...

[qdk0901]

@ludwig-v ,hi, do you have an Autokit flash dump?

[dmavromatis]

@ludwig-v hello?

[ludwig-v]

Sorry for the delay, had to buy a V3 to be sure.

"Rooted" my V3 the hard way: enjoy 🍿

[dmavromatis]

thanks! Flashed it -- works good so far!

[ludwig-v]

Activation : 192.168.50.2 on your phone, wait few seconds, activation success on screen, unplug & replug & done ;)

[dmavromatis]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

[qdk0901]

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

[ludwig-v]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

As far as you don't go back to original: by USB

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

Never really looked into this carefully (because it worked 🤟), I observed like you that it was doing something after the flash and that it could fail on different scenarios. Something sure is that eFUSEs are not burned with flash dumping

[mrmidnight273]

I'm having the issue as well with trying to install CFW on my V3. I've rolled back, I've rolled forward then back, and I am unable to flash my V3 with CFW. Any ideas, tips, or just wait?

[Converseallstar95]

Working great! -- so if we want to update the CFW on a v3.0 from now on, do we have to do it the "hard way" direct flash or can we do the traditional USB update?

As far as you don't go back to original: by USB

@ludwig-v the uboot seems doing AES encrypt to the uboot-env by device specific id(HW_OCOTP_CFG0 and HW_OCOTP_CFG1), the firmware copy from one device to another may failed, how can you get through with this

Never really looked into this carefully (because it worked 🤟), I observed like you that it was doing something after the flash and that it could fail on different scenarios. Something sure is that eFUSEs are not burned with flash dumping

I just flashed my bricked v3 with your CFW dump and it programmed successfully; however, when plug it into my car, it shows the activation screen but the SSID never broadcasts for me to activate it. I've tried reprogramming twice now. Any ideas?

I can update to the stock AUTOKIT firmware by USB and then the SSID broadcasts, but then I am no longer on CFW, since v3 can't be flashed to CFW by USB right?

Edit:
After I program the CFW bin, I updated to the Aug update through USB, then Dec, then Jan through OTA, so I am no longer on CFW; however, the Jan update brought a whole new web interface with more options. You can change the SSID and Bluetooth name, see connected devices (your phone named "Lud" was in the paired list) and more. There was also an option to uncheck logs from the settings menu in the hedunit (before it connects to your iPhone) as well.

Looking forward to a CFW of the Jan update with the Carplay theme to manually program :)

[Igor888991]

Guys, it's possible make the CP2A work on a Aftermarket display? My dongle turn on a red light when I plug it, but show me nothing but an eternal "loading".