Porsche 718 Forum banner
1 - 20 of 261 Posts

·
Registered
Joined
·
30 Posts
Discussion Starter · #1 · (Edited)
UPDATE May 2022 - The method documented below in detail works, however a faster method using only a card has been created. The steps are discussed in Android Auto / Nav etc... Do-It-Yourself-Thread. I will update this thread again with those steps in a little more detail make this easier to approach.

---

UPDATE Feb 2022- I have updated this content slightly on https://www.carpokes.com/viewtopic.php?p=2623. Overall, the instructions below are still accurate, but with a few bits to help backup and troubleshoot adapter identification.

---
I saw this thread and was also impressed with Chris's original work to hack the PCM. While I appreciate the efficiency of paying someone to hack your system, some people like to do it themselves. I wrote the following to start documenting how to access the PCM settings, and ultimately allow someone to add add Android Auto or other features. I'm not done writing this up, and I could use some screenshots.

This guide is designed to give you background knowledge and process on PCM hacking. It can be a primer for you to perform your own research necessary to modify your vehicle. Because of the differences in vehicles and layers of knowledge required to troubleshoot vehicle hacking, this guide is not a comprehensive walkthrough for ‘your’ car.


Terminology we will use

PCM
- Porsche Communication Management. This is the hardware and software making up the stereo, display panel, various antenna and radios, and available software features in a car. The standard PCM features are documented in the vehicle manual that comes with the car. Support and warranty is provided by your dealer and by Porsche.

MMX - the Multi Media Controller. A sub-component of the PCM system. Configurable over telnet on port 23

GEM - Green Engineering Menu. This is a ‘developer’ interface to the PCM which is initially locked out on Porsche vehicles. We will use GEM to gather information about the PCM beyond what is available in the standard interface. GEM is unsupported by Porsche. It is accessed by pressing specific buttons on your radio once the feature is unlocked by MIB.

MIB - More Incredible Bash. (Bash is ‘Bourne Again Shell’, a software interface native to many Unix/Linux operating systems). MIB provides an interface with predefined actions you can take on a PCM to modify its existing software features. This software is supported by a community of MHI2 hackers, and appears to be extensively documented in various forums.

MHI2 - This is the model PCM installed in the MY20 / 21 718’s. This model is made by Harman Automotive group. Harman is used by the Volkswagen Automotive Group in many vehicle lines including Bentley, Audi, Skoda, Volkswagen, Porsche. In laymens terms this is the 'radio' system in the car.

MY## - Model Year (## the year). MY21 is a 2021 year model car, MY20 is a 2020 year car etc.

FEC - Feature Enablement Code. These are numbers representing software features enabled in the PCM. Using GEM and MIB, you can query and export your car’s existing FEC’s and identify which features your car has (features represented on your build sheet, and features not represented on your build sheet but that are still configurable in the car). When modifying FEC’s in the PCM, a software license signing process must take place to activate the FEC feature. This signing process is done using tools possessed by authorized service centers. This process is circumvented by hackers by patching software running in the PCM.

File systems on the PCM - I'll come back to this and why patching your PCM isn't that difficult or dangerous.


Your Goals

You likely wish to add Android Auto, Navigation, Carplay, the Track Precision app or change a region or map pack on your car. Accessing these features are discussed in this walkthrough.

Overview of this guide
  • Prerequisites
  • Connecting to the car
  • Launching MIB
  • Enabling GEM
  • Patching the PCM
  • Enabling features

Prerequisites
You need a usb to ethernet adapter with chipset ASIX AX88772. Amazon sells a compatible one UGREEN Ethernet Adapter USB 2.0

Get a FAT32 formatted SD card, 16GB > if you are planning to upload maps, otherwise 1 and 2GB cards work.

Download MIB (215MB or so) from MIB Solution :: Login (login guest / guest). Unzip the contents of the MIB file into the SD card.

You need linux utilities ‘lsusb’, ‘ethtool’ and ‘ifconfig’ installed on a linux/unix computer that you can physically plug the usb->ethernet adapter into. There are many ways to install these utilities if you don’t have them already, use google.


Configure the ethernet adapter settings to imitate one Porsche allows.
Plug your usb->ethernet adapter into your linux/unix computer

Identify the USB->ethernet adapter plugged into your linux/unix system


From a terminal on your linux system

[email protected]:~$ ifconfig -s
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0 1500 0 0 0 0 0 0 0 0 0 BMU
enx000ec6728c57 0 0 0 0 0 0 0 0 0 0 BMPOU
lo 65536 0 184803277 0 0 0 184803277 0 0 0 LRU

Alternative

[email protected]:$ lshw -class network -short
WARNING: you should run this program as super-user.
H/W path Device Class Description
=====================================================
/0/100/4/0.1 eth6 network I350 Gigabit Network Connection
/1 enx0469f8ed33b3 network Ethernet interface
/2 enx000ec6728c57 network Ethernet interface

//Alternative

enx000ec6728c57
is our adapter. If you’re not sure which adapter is the right one, disconnect it, run ifconfig again and see which device ‘Iface’ is missing from the list.


Confirm the default pid/vid of the DUB-E100 usb->ethernet adapter. This is how the adapter appears to my linux machine before modifying it.
[email protected]:~$ lsusb | grep ASIX
Bus 001 Device 007: ID 0b95:7720 ASIX Electronics Corp. AX88772

0b95:7720 is the current pid/vid.


Flash the USB Adapter pid/vid

[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0088 value 0x01
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0089 value 0x20
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008A value 0x05
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x008B value 0x3c
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0048 value 0x01
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x0049 value 0x20
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004A value 0x05
[email protected]:~$ sudo ethtool -E enx000ec6728c57 magic 0xdeadbeef offset 0x004B value 0x3c



Unplug the usb->ethernet adapter. Plug it back in.

Check the output of lsusb to confirm our ethernet adapter represents the new pid/vid

[email protected]:~$ lsusb | grep ASIX
Bus 001 Device 008: ID 2001:3c05 D-Link Corp. DUB-E100 Fast Ethernet Adapter(rev.B1) [ASIX AX88772]

If you see 2001:3c05 you are successful. Now you have configured your adapter to be compatible with your Porsche PCM.


Connecting to the car
Plug the ethernet adapter into your car (glove box USB port)

Connect your laptop ethernet port with an ethernet cable to the usb->ethernet adapter plugged into the car (you should see lights on your adapter light up now)

Configure your laptop ethernet port with a static IP address, 172.16.250.250, subnet mask 255.255.255.0

Turn the car on but don’t start the engine.

telnet to the PCM RCC on port 123

[email protected]:~$telnet 172.16.250.248 123
This will prompt you for a login name and password

Login name: root
Password: look this up ahead of time, at MIB Solution :: Login

You will need to lookup your model PCM’s login credentials. A list of possible credentials is in the MIB zip file, 'date_MHI2_Password_List_V##.pdf'

On a US model MY21 718 PCM, root / CeaCCDmi were the credentials to login. Other model PCM credentials are in a pdf in the MIB download you put on the SD card.



Launching MIB
Put SD card in slot 1 - (driver side for US models)
# Mount SD card in slot SD1
mount -uw /net/mmx/fs/sda0/
# start M.I.B by typing
/net/mmx/fs/sda0/start

You will see a window now with a title ‘MIB’ and more colorful text.

If you got this far, now is a good time to turn off your car, and re-turn the key so that power does not turn off during next steps. You will telnet back to your PCM again and re-launch MIB to resume.



Backing up PCM
FIRST THING before you start changing settings in MIB. Run ‘Advanced Backup’.
You want a full backup of your PCM so if anything happens you have a place to restore from.
Full backup takes 5-10 minutes to write all data to SD card.



Enabling GEM
Look for the menu, ‘Developer Menu activation’. Run that. Your PCM will restart after dev mode is enabled. You may need to reconnect to your PCM over telnet.

After PCM has restarted, press ‘Car + Tuner’ buttons on the PCM for 3-5 seconds. You should see a menu which says ‘starting up’ in green text.



Install MIB in GEM
An option to install MIB into GEM exists in the MIB menu. Run that. This allows you to launch MIB without the need for your laptop. The SD card with MIB copied to it must be in the PCM to run MIB from GEM directly from the PCM.


Launch GEM using PCM buttons
Once you have enabled GEM and installed MIB, you can disconnect your laptop from the car.

Press and hold ‘Car’ + ‘Tuner’ buttons on the PCM for 5 seconds to launch GEM.

Browse around using the PCM dial knobs, you should be able to go forward in a menu or execute an action by pressing the dial button in while selected, to go back a menu roll the dial to the ‘..’ and press the dial button or use the back button on the PCM.


Patching the PCM
Launch GEM, open MIB - select ‘IFS-ROOT-Stage2 flash patched image’ and select a patch file that appears. (It will be the same version name ‘MHI2_US_POG11_P5177_MUA1453_PATCH’ as whatever you PCM displayed )

This patch will add several features, Nav, AA, Carplay, USB support, Sport chrono and some others which most people desire.

Once patched, the PCM will reboot. You can now run NAV and AA/Carplay, wifi, track app and so on.



Enabling features
WLAN menu - this is used to access the car’s hotspot and required for the lap time app use in Porsche.



Nav - turns on various navigation options


Check for GPS antenna
 

·
Registered
Joined
·
1 Posts
Morning all! New here and was thinking about giving this a try and wanted to see if anyone has tried or had any luck with doing this. Thanks
Did this 'hack' a couple of weeks back and can access Android Auto.

The latest MIB download (see link in original post) no longer requires the use of a laptop to connect to the car. Simply copy the files to a SD card (make sure you only copy the patch relevant to your unit in order to keep the file size down). The read me file in the download explains the process. The red engineering menu used to install the software is accessed by pressing the Media and Car buttons together and the green menu by pressing Tuner and Car. Remember to clear the error and install the patch before activating Android Auto - I didn't and got frustrated as to why the unit prompted to use device in AA mode but wouldn't give me the icon on the main screen. Once I realised my mistake, all works perfectly. I've kept the SD card I used in the slot, not sure if you need to once the flashing has completed but figured it doesn't hurt and at least I know where the card is should I need the backup.

Would say if you're of a nervous disposition then this may not be for you. There are several stages where the screen appears to freeze during the flashing process or goes blank for what seems like a long time while rebooting; therefore heed the warnings and don't be tempted to restart anything. Must admit there were a few moments where I thought I had bricked the headunit but my patience was rewarded.
 

·
Registered
2019 Cayman 2.0
Joined
·
6 Posts
Did this 'hack' a couple of weeks back and can access Android Auto.

The latest MIB download (see link in original post) no longer requires the use of a laptop to connect to the car. Simply copy the files to a SD card (make sure you only copy the patch relevant to your unit in order to keep the file size down). The read me file in the download explains the process. The red engineering menu used to install the software is accessed by pressing the Media and Car buttons together and the green menu by pressing Tuner and Car. Remember to clear the error and install the patch before activating Android Auto - I didn't and got frustrated as to why the unit prompted to use device in AA mode but wouldn't give me the icon on the main screen. Once I realised my mistake, all works perfectly. I've kept the SD card I used in the slot, not sure if you need to once the flashing has completed but figured it doesn't hurt and at least I know where the card is should I need the backup.

Would say if you're of a nervous disposition then this may not be for you. There are several stages where the screen appears to freeze during the flashing process or goes blank for what seems like a long time while rebooting; therefore heed the warnings and don't be tempted to restart anything. Must admit there were a few moments where I thought I had bricked the headunit but my patience was rewarded.
That's awesome! I'm nervous, however I have a good buddy that's going to do this as he's 100% linux literate.. Just wondering though, I'm planning on this for to enable the Carplay option and not the AA. Am I right in thinking it's the same process however just selecting which option you want to use?

Thanks for the insight and the replies!
 

·
Registered
Joined
·
30 Posts
Discussion Starter · #6 ·
That's awesome! I'm nervous, however I have a good buddy that's going to do this as he's 100% linux literate.. Just wondering though, I'm planning on this for to enable the Carplay option and not the AA. Am I right in thinking it's the same process however just selecting which option you want to use?

Thanks for the insight and the replies!
This would allow you to enable Carplay and/or Android Auto.
 

·
Registered
Joined
·
30 Posts
Discussion Starter · #7 ·
I'm not sure that is correct for US cars. Red Engineering menu is not available from my research. The telnet method was required to unlock GEM initially. (The two buttons did not launch GEM otherwise).

Did this 'hack' a couple of weeks back and can access Android Auto.

The latest MIB download (see link in original post) no longer requires the use of a laptop to connect to the car. Simply copy the files to a SD card (make sure you only copy the patch relevant to your unit in order to keep the file size down). The read me file in the download explains the process. The red engineering menu used to install the software is accessed by pressing the Media and Car buttons together and the green menu by pressing Tuner and Car.
 

·
Registered
Joined
·
4 Posts
I recently did this based on the information @edub provided. Once I fully wrapped my head around the instructions and terminology I successfully ran Linux from a bootable USB on my Mac and made this all happen. Although fairly computer literate, I have no coding or Linux background (ok maybe a tiny bit of archaic HTML experience).

I have the BOSE system and I have no issues so far.

If you already have Carplay, your car will already have a GPS antenna under the black plastics on the right side of the rear view mirror. If you don't already have Carplay you will need the add on antenna that can easily be plugged in behind the PCM and mounted under the sport chrono panel.
 

·
Registered
Joined
·
3 Posts
Did this 'hack' a couple of weeks back and can access Android Auto.

The latest MIB download (see link in original post) no longer requires the use of a laptop to connect to the car. Simply copy the files to a SD card (make sure you only copy the patch relevant to your unit in order to keep the file size down). The read me file in the download explains the process. The red engineering menu used to install the software is accessed by pressing the Media and Car buttons together and the green menu by pressing Tuner and Car. Remember to clear the error and install the patch before activating Android Auto - I didn't and got frustrated as to why the unit prompted to use device in AA mode but wouldn't give me the icon on the main screen. Once I realised my mistake, all works perfectly. I've kept the SD card I used in the slot, not sure if you need to once the flashing has completed but figured it doesn't hurt and at least I know where the card is should I need the backup.

Would say if you're of a nervous disposition then this may not be for you. There are several stages where the screen appears to freeze during the flashing process or goes blank for what seems like a long time while rebooting; therefore heed the warnings and don't be tempted to restart anything. Must admit there were a few moments where I thought I had bricked the headunit but my patience was rewarded.
Did you have the engine running through the process with stop/start disabled, or used an external power supply into the passenger footwell cigarette lighter socket?
 

·
Registered
Joined
·
3 Posts
Engine was off while I did mine and I had the battery connected to the charger to ensure I didn’t run the battery down.
Wish me luck, I am going in this evening...

Worked like a charm, and didn't have to use the d-link method. A shame the icon for Android Auto looks corrupted, and the font on Google Maps for street names etc. looks very fuzzy.
 

·
Registered
2018 Base Cayman 6MT, H&R springs, AgencyPower catback, MRR wheels
Joined
·
177 Posts
This was a nice find last weekend. I got NAV working on my US 2018 base Cayman (non-Bose) with factory CarPlay installed. I used the PC free method with MIB files extracted to a SD card. I my Android phone isn't running a stock rom so no AA on it to test yet. Thanks @edub for writing this up!
 

·
Registered
Joined
·
163 Posts
My FW version was not included on the downloaded file:
Gadget Font Display device Electronic device Communication Device


The closest one was the P4172

Font Electric blue Parallel Number Screenshot


I wonder if I should move forward with the procedure or not.

Edit:
I followed the instructions with more detail this time and found out you need to download the correct firmware version from the site mibsolution.one, I was looking for the same exact FW version but I couldn't find it so I thought my PCM wasn't supported, then reading closely I found there are supported versions that are stated on the right side of each FW:
Product Rectangle Azure Font Screenshot
 
1 - 20 of 261 Posts
Top