[beaups]

Someone correct me if I am wrong. I think there can be 2 approach to getting AA/ACP on 2017. Prerequisite are new hardware 2nd gen or above ETM and Dual USB ports installed in the center console:

1) NEW ETM from factory with no VIN attach to it. Hack Procsi to activate AA, then install new ETM to car, VIN will write to ETM on initial boot up. Use witech to activate AA/ACP on ETM. reboot and you are set to go.

Method number 2 may not be possible yet. But could be in future, require rewriting VIN to used ETM.

2) Same as above, first activate AA via procsi. Buy a used ETM that have been previously installed on another car that already have AA/ACP activated. Somehow we can find a way to rewrite the VIN on this used ETM to match your car's VIN. then there is no need to even use witech to activate AA/ACP offline. This method can possibly skip dealer visit.

What do you guys think?

The vin of the paired car is stored in the emmc of the ETM. /opt/vinmanager and /opt/antitheft directories for those that care IIRC. A daemon (/system/bin/vinmanager) requests the VIN of the vehicle via CAN and passes that info along to the antitheftdaemon. Without a vulnerability enabling (root) filesystem access to the ETM or programmatically changing the VIN of the car itself, #2 isn't going to work. I did find a few other tricks (temporary vinlock bypass) that I've been researching. One other possible option would be to connect directly to the emmc through debug points on the ETM mainboard, if they exist. I had some experience with that on phones in the past.

Finally, there is also a race condition in the script that runs when you restore the ETM to factory settings. But, it's a very short race and I'm unclear what could go wrong in the (very likely) event it's not timed correctly.

 

[Type952]

The vin of the paired car is stored in the emmc of the ETM. /opt/vinmanager and /opt/antitheft directories for those that care IIRC. A daemon (/system/bin/vinmanager) requests the VIN of the vehicle via CAN and passes that info along to the antitheftdaemon. Without a vulnerability enabling (root) filesystem access to the ETM or programmatically changing the VIN of the car itself, #2 isn't going to work. I did find a few other tricks (temporary vinlock bypass) that I've been researching. One other possible option would be to connect directly to the emmc through debug points on the ETM mainboard, if they exist. I had some experience with that on phones in the past.

Finally, there is also a race condition in the script that runs when you restore the ETM to factory settings. But, it's a very short race and I'm unclear what could go wrong in the (very likely) event it's not timed correctly.

Thx for the info. Well maybe Magneti Marelli will release the 4 digit code to unlock the unit in the future.

 

[beaups]

Thx for the info. Well maybe Magneti Marelli will release the 4 digit code to unlock the unit in the future.

In their software I see lots of references to a "master code" check, that I haven't reversed yet. Do you, or anyone else, know if that's a code that's created per-vehicle or if it's actually a single "master" code?

 

[epsonix]

@ratix, on original thread you mentioned: "only FCA can reset ETM" in context of attempt of enabling AA/ACP withhout proxi being prepared first. do you know any detail what exactly they need to do/how and if they need e.g. radio security code first?

somebody else mentnoned to use segger j-link, say I get one (or something similar), what software I need to use and what do I need to do in order to unlock back radio for AA/ACP or even back for full fresh start (clear VIN out of it)?
Does it help in any way that I have latest firmware copy (including 1.4GB bin file)? Flash radio with this in case there are any programming headers inside?

And last one, @beapus your post looks like you had their source code?

 

[beaups]

@ratix, on original thread you mentioned: "only FCA can reset ETM" in context of attempt of enabling AA/ACP withhout proxi being prepared first. do you know any detail what exactly they need to do/how and if they need e.g. radio security code first?

somebody else mentnoned to use segger j-link, say I get one (or something similar), what software I need to use and what do I need to do in order to unlock back radio for AA/ACP or even back for full fresh start (clear VIN out of it)?
Does it help in any way that I have latest firmware copy (including 1.4GB bin file)? Flash radio with this in case there are any programming headers inside?

And last one, @beapus your post looks like you had their source code?

I have no source code. I just partially REd one of the firmware updates, probably the same file you have.

 

[Beta Romeo]

Someone correct me if I am wrong. I think there can be 2 approach to getting AA/ACP on 2017. Prerequisite are new hardware 2nd gen or above ETM and Dual USB ports installed in the center console:

1) NEW ETM from factory with no VIN attach to it. Hack Procsi to activate AA, then install new ETM to car, VIN will write to ETM on initial boot up. Use witech to activate AA/ACP on ETM. reboot and you are set to go.

Method number 2 may not be possible yet. But could be in future, require rewriting VIN to used ETM or use the 4 digit unlock code.

2) Same as above, first activate AA via procsi. Buy a used ETM that have been previously installed on another car that already have AA/ACP activated. Install it on your car. Somehow we can find a way to rewrite the VIN on this used ETM to match your car's VIN. then there is no need to even use witech to activate AA/ACP offline. This method can possibly skip dealer visit.

What do you guys think?

Great post Type 952! And an update to my delay! I performed this on my car with a new unit activated in a 2018 model. I believe this will work with updating the procsi values and then performing an activation but have not confirmed. I actually have a trusted customer coming to me whom we never activated the AA on his 17 with which I will attempt to modify procsi and then attempt to activate AA, I also have a new unit as back-up. I want to see if the procsi version is viable before I write the how-to.

There is some good news that I noticed in reference to your #2. The new unit I received: P/N 68446430AA with software 85.000.046, did not seems to have the security code lock-out the old versions had! It is feasible that if an update becomes available to version .046, for second gen hardware, it could eliminate the security lock-out. Just a thought. Regardless, he is going to bring his vehicle to me the week of the 5th. I will try both versions of activation and will update you all. Thanks for your patience, I want to get it right and concise. I don't want anyone locking up a new unit.

 

[ratix]

All ETM units have security code ( old and new )
The only way to activate CarPlay in new unit is :
1 put the NEW ETM in one giulia 2018 with AA/ACP ( if don't have AA/ACP change proxy )
2 do the proxy alignment
3 do the CarPlay activation offline
4 remove ETM from 2018 Giulia
5 put ETM in 2017 giulia
6 change proxy
Done

ATTENTION
the car where the activation was made (giulia 2018 ) cannot be moved or ETM WILL LOCK and not work in 2017 giulia

 

[epsonix]

what you mean cannot be moved, you mean cannot be driven with the radio which we prepare for 2017 giulia?
instead of putting to 2018 car, equivalent would be to have proxi prepared the way previously suggested? is the proxi setup confirmed now, or it is still bit guessing?
what about radio which was attempted to activate AA/ACP in 2017 car not ready yet with proxi? how to get reset - any info on using programming interface, or reflashing radio (have bin file), or dealer (say I get security code) or any other trick?

 

[ratix]

Yes the car can not be driven
if you drive the car ETM will LOCK the vin and is no more possible put the ETM in other Giulia (2017)

Until now is impossible activate CarPlay in ETM mounted in giulia/stelvio 2016 2017 even if the proxy is changed

I've seen it done inside an ETM with One interface J-link
it unlocks the processor and activates CarPlay

 

[Beta Romeo]

Alright, I've got good news and bad news.

Good news: Android Auto Works. I have figured out the procsi settings to allow the android manual activation operation to be set and have confirmed this works on two cars and have activated android auto without using a late model car to activate.

Bad news: Apple CarPlay does NOT work. There is a separate procsi code for CarPlay, which I haven't figured out yet. There is a lot of trial and error and I don't have an iPhone to experiment with.

My previous procsi settings allowed Android Auto to work, but not allow it to be manually turned on with WiTech. Here is the process I found the easiest for AA activation(this has only been tested on USDM 2017 models):

This must be used on a version 2.5 radio module, and the radio must have never had the CarPlay activation manually set to off. The center console new 2-usb port must be installed on the vehicle.

1.) Using Multiecuscan, pull up the procsi table and copy it to a text file as a backup. Then:
Change byte 157 to 31. Change byte 161 to 03. Change byte 163 to 1A. Change byte 174 to 02. Write these values to the BCM. You can actually cancel out of the rest of the procsi write process as I found it cumbersome with different connectors, etc. I also found some modules simply not setting their procsi with MultiScanECU.
2.) Using WiTech, perform a procsi realignment under the BCM. This takes the procsi just written to the BCM and applies it to all other modules. This must be run TWICE, the first time it will procsi the cluster and one other module. Running it again will procsi all other modules. After the ABS module is re-procsi'd the Control Module Reprogram(Under ABS/Misc functions) must be run or else you will set a bunch of ABS codes.
3.) Under the ETM, Miscellaneous functions, run CarPlay manual activation. This will set to ON.
4.) Disconnect the battery and reconnect.
5.) Clear all codes. Android Auto should function normally.

Use these instructions at your own risk. I'm still working on the CarPlay procsi and you may want to wait to do it all at the same time. I just thought I'd update you and let you know I'm still on it!

 

[beaups]

What interface are you using with witech?

 

[Beta Romeo]

What interface are you using with witech?

Using Micropod 2, wireless Mopar adapter.

 

[Beta Romeo]

BTW, if anyone has an early 18 model that does not have AA or carplay installed and has not done any recalls or updates to the vehicle I would install AA or Carplay for free with the updated USB hub in order to get the before and after procsi values to the vehicle. These cars have a sales code build that gets changed when the procsi is restored to the vehicle and AA and Carplay procsi flags are enabled. If I could get my hands on one of these cars I could see what flags change, before and after. This would greatly accelerate my procsi flag search. PM me if anyone is interested. Thanks!

 

[ratix]

Alright, I've got good news and bad news.

Good news: Android Auto Works. I have figured out the procsi settings to allow the android manual activation operation to be set and have confirmed this works on two cars and have activated android auto without using a late model car to activate.

Bad news: Apple CarPlay does NOT work. There is a separate procsi code for CarPlay, which I haven't figured out yet. There is a lot of trial and error and I don't have an iPhone to experiment with.

My previous procsi settings allowed Android Auto to work, but not allow it to be manually turned on with WiTech. Here is the process I found the easiest for AA activation(this has only been tested on USDM 2017 models):

This must be used on a version 2.5 radio module, and the radio must have never had the CarPlay activation manually set to off. The center console new 2-usb port must be installed on the vehicle.

1.) Using Multiecuscan, pull up the procsi table and copy it to a text file as a backup. Then:
Change byte 157 to 31. Change byte 161 to 03. Change byte 163 to 1A. Change byte 174 to 02. Write these values to the BCM. You can actually cancel out of the rest of the procsi write process as I found it cumbersome with different connectors, etc. I also found some modules simply not setting their procsi with MultiScanECU.
2.) Using WiTech, perform a procsi realignment under the BCM. This takes the procsi just written to the BCM and applies it to all other modules. This must be run TWICE, the first time it will procsi the cluster and one other module. Running it again will procsi all other modules. After the ABS module is re-procsi'd the Control Module Reprogram(Under ABS/Misc functions) must be run or else you will set a bunch of ABS codes.
3.) Under the ETM, Miscellaneous functions, run CarPlay manual activation. This will set to ON.
4.) Disconnect the battery and reconnect.
5.) Clear all codes. Android Auto should function normally.

Use these instructions at your own risk. I'm still working on the CarPlay procsi and you may want to wait to do it all at the same time. I just thought I'd update you and let you know I'm still on it!

I think you must to change byte 115
14 -> 15

 

[Beta Romeo]

I think you must to change byte 115
14 -> 15

I don't know what kind of connections you have or who you are, but that worked. AA and CarPlay are now functional. Nice work Ratix! A true community solution! I will update the process and will do a full write up with pictures soon. I have another forum member/regular customer who wants this enabled. I will provide the walkthrough with his data. Thanks again to Ratix!

 

[ratix]

Beta Romeo the cars you activate AA/ACP what's is the letter in ten position of VIN ? Is H or J ?

 

[Crosshairs]

Alright, I've got good news and bad news.

Good news: Android Auto Works. I have figured out the procsi settings to allow the android manual activation operation to be set and have confirmed this works on two cars and have activated android auto without using a late model car to activate.

Bad news: Apple CarPlay does NOT work. There is a separate procsi code for CarPlay, which I haven't figured out yet. There is a lot of trial and error and I don't have an iPhone to experiment with.

My previous procsi settings allowed Android Auto to work, but not allow it to be manually turned on with WiTech. Here is the process I found the easiest for AA activation(this has only been tested on USDM 2017 models):

This must be used on a version 2.5 radio module, and the radio must have never had the CarPlay activation manually set to off. The center console new 2-usb port must be installed on the vehicle.

Im wondering if changing the sales code and then restoring the vehicle configuration would work....have you tried it that way?

 

[Beta Romeo]

Beta Romeo the cars you activate AA/ACP what's is the letter in ten position of VIN ? Is H or J ?

H

 

[Beta Romeo]

Im wondering if changing the sales code and then restoring the vehicle configuration would work....have you tried it that way?

We can only change sales codes for vehicles based on the VIN. I've tried this on a 2017 and the AA and CarPlay options are not available to input.

 

[Crosshairs]

We can only change sales codes for vehicles based on the VIN. I've tried this on a 2017 and the AA and CarPlay options are not available to input.

Ah yes, I forgot it wasn't available at all in 2017

I dont have a Multiecuscan so I was hoping for an easier way.....