Can we talk about Activation?

[j0wns]

I've been reading the discussions in this community but I'm not finding clear instructions for how to deal with a device that demands activation.

I do not have a copy of the bin prior to the appearance of the activation message.

My device is running the @bronken dump from Flash Dump but demands activation.

Model: CPC200-U2W Plus
Board Version: A15 V01.5 2020-09-03

/cgi-bin/server.cgi?cmd=getversion

{
	"version":"2021.03.06.1343",
	"type":"PU",
	"boxMac":"00:e0:4c:53:63:2c",
	"fileName":"U2W_Update.img"
}

/cgi-bin/server.cgi?cmd=is_box_activated

{
	"uuid":"5988f5252409b1d7adf828816a307e56",
	"old_uuid":"5988f541142b89d7798d4bf009515697",
	"manufacturer":"GuanSheng",
	"isActivated":0,
	"code":"cpN2EqFmrKxV2LN5WE7QB6QKcsXa4bTd",
	"boxType":"PU",
	"carManufacturer":"SUBARU STARLINK S",
	"carModel":"SUBARU STARLINK S",
	"carOemName":"SUBARU",
	"carResolution":"800x480",
	"productType":"U2W"
}

Is this recoverable?

I've flashed the @bronken bin and tried putting U2W_Update_2020.11.10.2138_ROLLBACK.img on a USB with various names, but it's does not make the lights flash. @ludwig-v

Can anyone with relevant experience find it in their heart to guide me?
I don't want to keep guessing at my next steps and makings worse than they've become.
Your insight will be appreciated.

---

Background

I've realized the CarlinKit and its software are the ideal Honey Trap for the inquisitive.
We're all here because we are in some way curious, politely obedient, willfully DISobedient, or are generally just a glutton for punishment.

I want to drop as many notes and keywords as possible so future readers might recognize where they've gone wrong, get on the right path, OR quit while they are ahead!
Together, we can write some triage steps.

---

What I've done

Day 0

I have an earlier U2W-02 device purchased in November 2020 from a Gary Chum at carplaying.com.
I bricked it the very first day following prompts for an over-the-air update.
🤦‍♂️ Thanks, Gary

I attempted to manually update via USB with firmware from this repo but I didn't get anywhere at the time (December 2020). I felt sad and foolish so I put it and my shame in a box for four years hoping time and benign neglect would solve my problem.

Three days ago I decided now was a good time to open Pandora's box and tempt fate once again.

---

Day N+1 : The Unboxing Redux

The case is matte black (No pseudo carbon fiber)
The front says CarlinKit CPC200-U2W Plus and has a red/green light bar.
The back restates the model CPC200-U2W Plus, I/O Voltages, etc.

I removed the backing with a thin metal prying tool and found the board version.
Board Version: A15 V01.5 2020-09-03
Variant: U2W-02

FRONT

BACK

I found and read Unbricking #72 and since I didn't have a CH431A Programmer I tried different IMG files until one took.

I tried updating from the U2W firmware via USB again.
I saw the warnings about dates, and I knew U2W but I didn't and still don't understand the significance of the four directories in firmware:

• _
• _AUTOKIT
• _CP2AIR/2022.01.24.1914
• _ZYD

My note taking was non existent at this point but I'm pretty confident the first file that was accepted Firmware/U2W/_ZYD/2020.08.27.1759/

It worked! (I thought)

I didn't reconize the AutoKit-582f SSID but the default password of 12345678 was accepted.

Wifi SSID

The error on the web page was forboding but I tried it in the car ANYWAY.

DASH

It really worked! What did I do?

/cgi-bin/server.cgi?cmd=getversion

{
	"version":"2020.08.27.1759",
	"type":"JU",
	"boxMac":"00:e0:4c:24:bd:a6",
	"fileName":"U2W_ZYD_Update.img"
}

What about that error on the web page...

FOOLS BANE

I updated via USB to MARCH 2021 _ZYD version. It took using the ZYD file variant.
/cgi-bin/server.cgi?cmd=getversion

{
	"version":"2021.03.10.1430",
	"type":"JU",
	"boxMac":"00:e0:4c:53:63:2c",
	"fileName":"U2W_ZYD_Update.img"
}

The foreboding web page was slightly different but still there, mocking me.

There were new settings!

Now my device wanted to be activated.

This is where I wish I quit when I was ahead.
I ordered a CH341A Programmer and put everything away.

Day N+2

I didn't keep very good notes.
I tried upgrading via USB.
I tried downgrading via USB.
I tried a lot of things.
I didn't get anywhere.

Day N+3

With the CH341A Programmer on hand I back up the current firmware image.
I flash to bronken's dump. I get a variant of the same state I was in at the end of day one.

I got a lot of practice with the tools and trying the various flashdump binaries.

I briefly was on one of the custom firmwares that I thought failed but I found a userspace.log file on my USB when I was trying to switch to use USB to downgrade to U2W_Update_2020.11.10.2138_ROLLBACK.img

**************************************
Kernel version:linux-3.0.15
iMX6UL 14x14 evk board rootfs
Designer:ShiKai
Date:2015.11.3
**************************************
Software Vserion: 2020.10.27.1239
Start Main Service!!!

In the end, I reprogrammed the chip with bronken's dump and connected to it to my vehicle to collect data for this post.
The current state (needing activation) is at the top of this post.

halp pls

[ludwig-v]

Unfortunately without any previous backup you won't be able to restore /etc/uuid_sign (Activation data), I don't think Carlinkit will help (requires a login / password and a recent version because old APIs have been cut)

[ludwig-v]

Update: You can now install Custom Firmware and use any nulled binary to bypass activation and restore your device 🥳